Vulnerability Database

300,830

Total vulnerabilities in the database

CVE-2022-37041

An issue was discovered in ProxyServlet.java in the /proxy servlet in Zimbra Collaboration Suite (ZCS) 8.8.15 and 9.0. The value of the X-Forwarded-Host header overwrites the value of the Host header in proxied requests. The value of X-Forwarded-Host header is not checked against the whitelist of hosts that ZCS is allowed to proxy to (the zimbraProxyAllowedDomains setting).

  • Published: Aug 12, 2022
  • Updated: Apr 14, 2023
  • CVE: CVE-2022-37041
  • Severity: High
  • Exploit:

CVSS v3:

  • Severity: High
  • Score: 7.5
  • AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

CWEs:

Software From Fixed in
zimbra / collaboration 9.0.0 9.0.0.x
zimbra / collaboration 8.8.15 8.8.15.x