{
  "_links": {
    "capec": {
      "href": "/api/v1/vulnerability/cve-2022-41352/capec"
    },
    "cvss": {
      "href": "/api/v1/vulnerability/cve-2022-41352/cvss"
    },
    "cwe": {
      "href": "/api/v1/vulnerability/cve-2022-41352/cwe"
    },
    "enrichment": {
      "href": "/api/v1/vulnerability/cve-2022-41352/enrichment"
    },
    "gcve": {
      "href": "/api/v1/vulnerability/cve-2022-41352/gcve"
    },
    "self": {
      "href": "/api/v1/vulnerability/cve-2022-41352"
    },
    "sightings": {
      "href": "/api/v1/sightings/cve-2022-41352"
    }
  },
  "enrichments": {
    "cisa-kev": {
      "kev": true
    },
    "epss": {
      "epss": 0.95478,
      "kev": true,
      "percentile": 0.99868
    },
    "nuclei": {
      "nuclei": true,
      "nuclei_template": "http/cves/2022/CVE-2022-41352.yaml",
      "nuclei_template_severity": "critical",
      "nuclei_template_yaml": "id: CVE-2022-41352\n\ninfo:\n  name: Zimbra Collaboration - Unrestricted File Upload\n  author: rxerium\n  severity: critical\n  description: |\n    An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0. An attacker can upload arbitrary files through amavis via a cpio loophole (extraction to /opt/zimbra/jetty/webapps/zimbra/public) that can lead to incorrect access to any other user accounts. Zimbra recommends pax over cpio. Also, pax is in the prerequisites of Zimbra on Ubuntu; however, pax is no longer part of a default Red Hat installation after RHEL 6 (or CentOS 6). Once pax is installed, amavis automatically prefers it over cpio.\n  impact: |\n    Unauthenticated attackers can upload arbitrary files through amavis via a cpio loophole that extracts to the webapps directory, potentially achieving remote code execution and unauthorized access to other user accounts in Zimbra Collaboration Suite.\n  remediation: |\n    Install pax package and ensure amavis is configured to use pax instead of cpio. Update to the latest patched version of Zimbra Collaboration Suite.\n  reference:\n    - https://www.secpod.com/blog/unpatched-rce-bug-in-zimbra-collaboration-suite-exploited-in-wild/\n    - https://nvd.nist.gov/vuln/detail/CVE-2022-41352\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2022-41352\n    cwe-id: CWE-22\n    epss-score: 0.95478\n    epss-percentile: 0.99868\n    cpe: cpe:2.3:a:zimbra:collaboration:8.8.15:-:*:*:*:*:*:*\n  metadata:\n    max-request: 1\n    vendor: zimbra\n    product: collaboration\n    shodan-query:\n      - http.favicon.hash:\"1624375939\"\n      - http.html:\"Zimbra Collaboration Suite Web Client\"\n    fofa-query: icon_hash=\"1624375939\"\n  tags: cve,cve2022,zimbra,kev,file-upload,passive,vkev,vuln\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}/js/zimbraMail/share/model/ZmSettings.js\"\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - \"Zimbra Collaboration Suite Web Client\"\n\n      - type: word\n        part: content_type\n        words:\n          - \"application/x-javascript\"\n\n      - type: word\n        part: body\n        words:\n          - \"8.8.15\"\n          - \"9.0\"\n        condition: or\n\n    extractors:\n      - type: regex\n        part: body\n        group: 1\n        regex:\n          - 'CLIENT_VERSION\",\\s*{type:ZmSetting\\.T_CONFIG,\\s*defaultValue:\"(.*?)\"'\n# digest: 4b0a004830460221008ec94a51f1bef4ebf395cbea6ba06afe208ebd1c76f361ebf5bd7d52e64e6b1e022100c3f8169caad4b27c43ae114d238ec87f7f68855cb794643153ae35d71b9548a1:922c64590222798bb761d5b6d8e72950"
    }
  },
  "vuln_id": "cve-2022-41352"
}