CVE-2022-37042

KEV catalog · CISA Known Exploited Vulnerabilities

CVE-2022-37042 9.8

Synacor · Zimbra Collaboration Suite (ZCS) · Added 2022-08-11 · Published 2022-08-12

3-Day Required PoC Available KEV Automatable Active Exploitation

Details

VulnerabilitySynacor Zimbra Collaboration Suite (ZCS) Authentication Bypass Vulnerability

VendorSynacor

ProductZimbra Collaboration Suite (ZCS)

Date added2022-08-11

Due date2022-09-01

CISA catalogView on CISA KEV catalog

Required actionApply updates per vendor instructions.

CWECWE-22

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Descriptions

KEV: Synacor Zimbra Collaboration Suite (ZCS) contains an authentication bypass vulnerability in MailboxImportServlet. This vulnerability was chained with CVE-2022-27925 which allows for unauthenticated remote code execution.

NVD: Zimbra Collaboration Suite (ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it. By bypassing authentication (i.e., not having an authtoken), an attacker can upload arbitrary files to the system, leading to directory traversal and remote code execution. NOTE: this issue exists because of an incomplete fix for CVE-2022-27925.

Compliance SSVC + BOD 26-04

Automatableyes

Technical impacttotal

Exploitation statusactive

3-day qualifyingYes

Public timeline3 days + forensic

Non-public timeline3 days + forensic

Forensic (public)Required

Forensic (non-public)Required

Research metadata

Last researched2026-09-12 09:42 UTC

Wall time0.6s

Searches1

Component defaultyes

Sources https://nvd.nist.gov/vuln/detail/CVE-2022-37042
https://blog.zimbra.com/2022/08/authentication-bypass-in-mailboximportservlet-vulnerability/
https://www.volexity.com/blog/2022/08/10/mass-exploitation-of-unauthenticated-zimbra-rce-cve-2022-27925/
https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-228a
https://wiki.zimbra.com/wiki/Security_Center
https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P26
https://github.com/0xf4n9x/CVE-2022-37042
https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-37042.yaml

Hunting hypothesis agent

Hunt Zimbra mailboxd access logs for POSTs to /service/extension/backup/mboximport with account-name=admin&ow=cmd (often 401) plus traversal ZIP entries, followed by GETs to new /zimbraAdmin/*.jsp webshells.

Research details

ComponentMailboxImportServlet mboximport handler (/service/extension/backup/mboximport)

PreconditionsUnauthenticated network access to the Zimbra mailboxd/web service (ports 80/443, or 7071 admin) running affected ZCS 8.8.15 before Patch 33 or 9.0 before Patch 26. MailboxImportServlet performs an authtoken check but does not return when it fails, so a crafted POST with account-name/account-status/ow parameters is still processed; the attacker uploads a ZIP whose member filename contains ../ traversal to drop a JSP webshell. agent

DeliveryUnauthenticated HTTP POST to /service/extension/backup/mboximport carrying a crafted ZIP archive with ../ traversal member filenames; the extracted JSP is then requested over HTTP to execute code.

Public PoCyes

PoC URLs https://github.com/0xf4n9x/CVE-2022-37042
https://github.com/vnhacker1337/CVE-2022-27925-PoC
https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-37042.yaml
https://github.com/aels/CVE-2022-37042 Third-party repos; verify before use.

Advisoryhttps://blog.zimbra.com/2022/08/authentication-bypass-in-mailboximportservlet-vulnerability/

Exploit notesCVSS attack complexity: LOW | CRITICAL severity (CVSS >= 9.0). The missing return after the authentication check makes the MailboxImportServlet reachable without an authtoken. Public exploit tooling and a Nuclei template are available; the bypass chains with CVE-2022-27925 to write a JSP webshell via ZIP path traversal and achieve unauthenticated remote code execution.

SummaryCVE-2022-37042 is an authentication bypass in Zimbra Collaboration Suite's MailboxImportServlet (mboximport endpoint). The servlet checks for a valid authtoken but does not return on failure, so an unauthenticated attacker can supply crafted account-name/account-status/ow parameters and have a ZIP archive processed. Chained with CVE-2022-27925, this lets an unauthenticated attacker write a JSP webshell via directory traversal and execute remote code; Zimbra fixed it in 8.8.15 Patch 33 and 9.0.0 Patch 26, and it was mass-exploited in 2022.

Tia coverage

First reported2026-09-24

When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.

Mentioned in

when-business-email-compromise-starts-rewriting-reality

Record schema v1.0. Enrichment is research-grade, not a substitute for analyst review.