CVE-2019-9621

UNKNOWN

Published 2019-04-30T17:40:53.000Z

Actions:

Expert Analysis

Professional remediation guidance

Get tailored security recommendations from our analyst team for CVE-2019-9621. We'll provide specific mitigation strategies based on your environment and risk profile.

CVSS Score

V3.1

7.5

/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Base Score Metrics

Exploitability: N/A Impact: N/A

EPSS Score

v2025.03.14

0.918

probability

of exploitation in the wild

There is a 91.8% chance that this vulnerability will be exploited in the wild within the next 30 days.

Updated: 2025-06-25

Exploit Probability

Percentile: 0.997

Higher than 99.7% of all CVEs

Attack Vector Metrics

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Impact Metrics

Confidentiality

HIGH

Integrity

NONE

Availability

NONE

Description

Zimbra Collaboration Suite before 8.6 patch 13, 8.7.x before 8.7.11 patch 10, and 8.8.x before 8.8.10 patch 7 or 8.8.x before 8.8.11 patch 3 allows SSRF via the ProxyServlet component.

Available Exploits

No exploits available for this CVE.

Related News

Zimbra Multiple Vulnerabilities

Multiple vulnerabilities were identified in Zimbra. A remote attacker could exploit some of these vulnerabilities to trigger denial of service condition, remote code execution and cross-site scripting on the targeted system. Note: CVE-2019-9621 is being …

Hkcert.org 2025-07-08 01:00

Known Exploited Vulnerability

This vulnerability is actively being exploited in the wild

View KEV Details

Remediation Status

Overdue

Due Date

July 28, 2025

Added to KEV

July 7, 2025

Required Action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Affected Product

Vendor/Project: Synacor

Product: Zimbra Collaboration Suite (ZCS)

Ransomware Risk

Known Ransomware Use

KEV Catalog Version: 2025.07.07 Released: July 7, 2025

GitHub Security Advisories

Community-driven vulnerability intelligence from GitHub

⚠ Unreviewed HIGH

GHSA-gf2h-5qx6-v9fr

Advisory Details

Zimbra Collaboration Suite before 8.6 patch 13, 8.7.x before 8.7.11 patch 10, and 8.8.x before 8.8.10 patch 7 or 8.8.x before 8.8.11 patch 3 allows SSRF via the ProxyServlet component.

CVSS Scoring

CVSS Score

7.5

CVSS Vector


                                    CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2019-9621

WEB https://blog.tint0.com/2019/03/a-saga-of-code-executions-on-zimbra.html

WEB https://blog.zimbra.com/2019/03/9826

WEB https://bugzilla.zimbra.com/show_bug.cgi?id=109127

WEB https://wiki.zimbra.com/wiki/Security_Center

WEB https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories

WEB https://www.exploit-db.com/exploits/46693

WEB http://packetstormsecurity.com/files/152487/Zimbra-Collaboration-Autodiscover-Servlet-XXE-ProxyServlet-SSRF.html

WEB http://packetstormsecurity.com/files/153190/Zimbra-XML-Injection-Server-Side-Request-Forgery.html

WEB http://www.rapid7.com/db/modules/exploit/linux/http/zimbra_xxe_rce

Advisory provided by GitHub Security Advisory Database. Published: May 24, 2022, Modified: April 4, 2024

Social Media Intelligence

Real-time discussions and threat intelligence from social platforms

1 post

Reddit • 2 months, 3 weeks ago

_cybersecurity_

Exploit

CISA Flags Four Critical Vulnerabilities Amid Rising Threats **CISA has added four serious vulnerabilities to its catalog, warning of active exploitation and urging immediate updates.** **Key Points:** - CISA adds four vulnerabilities to the KEV catalog due to active exploitation. - CVE-2014-3931 and CVE-2016-10033 have CVSS scores of 9.8, indicating …

Also mentions: CVE-2016-10033 CVE-2014-3931

4.0

View Original High Risk