Exploit for #VU52298 XML External Entity injection in Zimbra Collaboration

Vulnerability identifier: #VU52298

Vulnerability risk: Medium

CVSSv4.0: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:A/U:Green]

CVE-ID: CVE-2019-9670

CWE-ID: CWE-611

Exploitation vector: Network

Exploits in database: 3

• August 16, 2022
  • zaber (?️ Yet another CVE-2019-9670 exploit, but in Golang.) [Github]
• June 29, 2022
  • arbimz (? Arbimz is a python tool created to exploit the vulnerability on Zimbra assigned as CVE-2019-9670.) [Github]
• April 16, 2021
  • Zimbra-RCE (Zimbra RCE PoC - CVE-2019-9670 XXE/SSRF) [Github]

Vulnerable software:
Zimbra Collaboration
Web applications / Webmail solutions

Vendor: Synacor Inc.