CVE-2020-12846

high-risk

Published 2020-06-03

Zimbra before 8.8.15 Patch 10 and 9.x before 9.0.0 Patch 3 allows remote code execution via an avatar file. There is potential abuse of /service/upload servlet in the webmail subsystem. A user can upload executable files (exe,sh,bat,jar) in the Contact section of the mailbox as an avatar image for a contact. A user will receive a "Corrupt File" error, but the file is still uploaded and stored locally in /opt/zimbra/data/tmp/upload/, leaving it open to possible remote execution.

Do I need to act?

10.9% chance of exploitation in next 30 days

EPSS score — higher than 89% of all CVEs

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 8.0/10 High

NETWORK / LOW complexity

Affected Products (14)

Zimbra Collaboration Suite

Affected Vendors

Synacor

References (6)

Release Notes https://wiki.zimbra.com/wiki/Security_Center

Vendor Advisory https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P3

Vendor Advisory https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories

Release Notes https://wiki.zimbra.com/wiki/Security_Center

Vendor Advisory https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P3

Vendor Advisory https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories

/ 100

high-risk

Severity 28/34 · Critical

Exploitability 11/34 · Low

Exposure 18/34 · Moderate