{
  "_links": {
    "capec": {
      "href": "/api/v1/vulnerability/cve-2022-27924/capec"
    },
    "cvss": {
      "href": "/api/v1/vulnerability/cve-2022-27924/cvss"
    },
    "cwe": {
      "href": "/api/v1/vulnerability/cve-2022-27924/cwe"
    },
    "enrichment": {
      "href": "/api/v1/vulnerability/cve-2022-27924/enrichment"
    },
    "gcve": {
      "href": "/api/v1/vulnerability/cve-2022-27924/gcve"
    },
    "self": {
      "href": "/api/v1/vulnerability/cve-2022-27924"
    },
    "sightings": {
      "href": "/api/v1/sightings/cve-2022-27924"
    }
  },
  "enrichments": {
    "cisa-kev": {
      "kev": true
    },
    "epss": {
      "epss": 0.85398,
      "kev": true,
      "percentile": 0.99709
    },
    "nuclei": {
      "nuclei": true,
      "nuclei_template": "http/cves/2022/CVE-2022-27924.yaml",
      "nuclei_template_severity": "high",
      "nuclei_template_yaml": "id: CVE-2022-27924\n\ninfo:\n  name: Zimbra Collaboration Suite - Memcached Command Injection\n  author: rxerium\n  severity: high\n  description: |\n    Zimbra Collaboration Suite versions 8.8.15 and 9.0 contain a memcached command injection vulnerability that allows an unauthenticated attacker to inject arbitrary memcache commands into a targeted instance, leading to cache poisoning and potential credential theft.\n  impact: |\n    Successful exploitation allows attackers to overwrite arbitrary cached entries and steal user credentials in cleartext without user interaction. With valid credentials, attackers can perform spear phishing, social engineering, and business email compromise attacks, or maintain persistent access via webshells.\n  remediation: |\n    Update to Zimbra Collaboration Suite version 8.8.15 Patch 31 or 9.0.0 Patch 24.1 or later. Implement multi-factor authentication to mitigate credential theft impact.\n  reference:\n    - https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories\n    - https://nvd.nist.gov/vuln/detail/CVE-2022-27924\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2022-27924\n    epss-score: 0.85398\n    epss-percentile: 0.99709\n    cpe: cpe:2.3:a:synacor:zimbra_collaboration_suite:*:*:*:*:*:*:*:*\n  metadata:\n    verified: true\n    max-request: 1\n    vendor: synacor\n    product: zimbra_collaboration_suite\n    shodan-query:\n      - http.title:\"zimbra collaboration suite\"\n  tags: cve,cve2022,zimbra,injection,passive,vuln,kev,vkev\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}/js/zimbraMail/share/model/ZmSettings.js\"\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - \"Zimbra Collaboration Suite Web Client\"\n\n      - type: word\n        part: header\n        words:\n          - \"application/x-javascript\"\n\n      - type: word\n        words:\n          - \"8.8.15\"\n          - \"9.0\"\n        part: version\n\n      - type: status\n        status:\n          - 200\n\n    extractors:\n      - type: regex\n        name: version\n        part: body\n        group: 1\n        regex:\n          - 'CLIENT_VERSION\\\",\\s+{type:ZmSetting.T_CONFIG, defaultValue:\\\"(.*?)\"'\n# digest: 4b0a0048304602210096f430b12a82c6806ca92a0817f95417cae81e1e4c403304efa7dfaf7a17a44d022100c17e8107a4b771ef3cdad129f6948f67e6e1671d1758c09c65b5664a2e90ce76:922c64590222798bb761d5b6d8e72950"
    }
  },
  "vuln_id": "cve-2022-27924"
}