CISA Known Exploited Vulnerability

CVE-2022-41352

Synacor · Zimbra Collaboration Suite (ZCS)

Synacor Zimbra Collaboration Suite (ZCS) Arbitrary File Upload Vulnerability

Date added 2022-10-20

BOD 22-01 due date 2022-11-10

CWE CWE-22

Ransomware Unknown

CISA description

Synacor Zimbra Collaboration Suite (ZCS) allows an attacker to upload arbitrary files using cpio package to gain incorrect access to any other user accounts.

Required action

Apply updates per vendor instructions.

Notes & references

https://wiki.zimbra.com/wiki/Security_Center
https://nvd.nist.gov/vuln/detail/CVE-2022-41352

Where this lands in 800-53

Vulnerability data triggers these controls during assessment and continuous monitoring.

RA-5 · Vulnerability Monitoring and Scanning
SI-2 · Flaw Remediation
CM-6 · Configuration Settings
SI-7 · Software, Firmware, and Information Integrity
CM-8 · System Component Inventory

External lookups

NVD · CVE-2022-41352
CVE.org · CVE-2022-41352
CISA KEV catalog (canonical)