CISA Adds Zimbra Email Vulnerability to its Exploited Vulnerabilities Catalog

The U.S. Cybersecurity and Infrastructure Security Agency (CISA)
on Thursday added a recently disclosed high-severity vulnerability
in the Zimbra email suite to its Known Exploited Vulnerabilities
Catalog^[1], citing evidence of active exploitation^[2].

The issue in question is CVE-2022-27924^[3]
(CVSS score: 7.5), a command injection flaw in the platform that
could lead to the execution of arbitrary Memcached commands and
theft of sensitive information.

“Zimbra Collaboration (ZCS) allows an attacker to inject
memcached commands into a targeted instance which causes an
overwrite of arbitrary cached entries,” CISA said.

Specifically, the bug relates to a case of insufficient
validation of user input that, if successfully exploited, could
enable attackers to steal cleartext credentials from users of
targeted Zimbra instances.

The issue was disclosed^[4]
by SonarSource in June, with patches^[5]
released by Zimbra on May 10, 2022, in versions 8.8.15 P31.1 and
9.0.0 P24.1.

CISA hasn’t shared technical details of the attacks that exploit
the vulnerability in the wild and has yet to attribute it to a
certain threat actor.

In the light of active exploitation of the flaw, users are
recommended to apply the updates to the software to reduce their
exposure to potential cyberattacks.