CVE-2019-9670

CriticalCVSS 9.8/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

mailboxd component in Synacor Zimbra Collaboration Suite 8.7.x before 8.7.11p10 has an XML External Entity injection (XXE) vulnerability, as demonstrated by Autodiscover/Autodiscover.xml.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-611

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.com/files/152487/Zimbra-Collaboration-Autodiscover-Servlet-XXE-ProxyServlet-SSRF.htmlExploit, Third Party Advisory, VDB Entry
http://www.rapid7.com/db/modules/exploit/linux/http/zimbra_xxe_rceThird Party Advisory
https://bugzilla.zimbra.com/show_bug.cgi?id=109129Broken Link, Issue Tracking, Patch, Third Party Advisory
https://isc.sans.edu/forums/diary/CVE20199670+Zimbra+Collaboration+Suite+XXE+vulnerability/27570/Exploit, Third Party Advisory
https://wiki.zimbra.com/wiki/Zimbra_Security_AdvisoriesVendor Advisory
https://www.exploit-db.com/exploits/46693/Exploit, Third Party Advisory, VDB Entry
http://packetstormsecurity.com/files/152487/Zimbra-Collaboration-Autodiscover-Servlet-XXE-ProxyServlet-SSRF.htmlExploit, Third Party Advisory, VDB Entry
http://www.rapid7.com/db/modules/exploit/linux/http/zimbra_xxe_rceThird Party Advisory
https://bugzilla.zimbra.com/show_bug.cgi?id=109129Broken Link, Issue Tracking, Patch, Third Party Advisory
https://isc.sans.edu/forums/diary/CVE20199670+Zimbra+Collaboration+Suite+XXE+vulnerability/27570/Exploit, Third Party Advisory
https://wiki.zimbra.com/wiki/Zimbra_Security_AdvisoriesVendor Advisory
https://www.exploit-db.com/exploits/46693/Exploit, Third Party Advisory, VDB Entry
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-9670US Government Resource

Timeline

Published: May 29, 2019
Last modified: Jun 17, 2026
Added to CISA KEV: Jan 10, 2022
NVD status: Analyzed

Related CVEs from 2019

CVE-2019-96738.8Freenet 1483 has a MIME type bypass that allows arbitrary JavaScript execution via a crafted Freenet URI.CVE-2019-96747.5Lib/zipfile.py in Python through 3.7.2 allows remote attackers to cause a denial of service (resource consumption) via a ZIP bomb.CVE-2019-96758.1An issue was discovered in PHP 7.x before 7.1.27 and 7.3.x before 7.3.3. phar_tar_writeheaders_int in ext/phar/tar.c has a buffer overflow v CVE-2019-96767.8Buffer overflow vulnerability found in some Dahua IP Camera devices IPC-HFW1XXX,IPC-HDW1XXX,IPC-HFW2XXX Build before 2018/11. The vulnerabil CVE-2019-96779.8The specific fields of CGI interface of some Dahua products are not strictly verified, an attacker can cause a buffer overflow by constructi CVE-2019-96787.5Some Dahua products have the problem of denial of service during the login process. An attacker can cause a device crashed by constructing a CVE-2019-96798.8Some of Dahua's Debug functions do not have permission separation. Low-privileged users can use the Debug function after logging in. Affecte CVE-2019-96805.3Some Dahua products have information leakage issues. Attackers can obtain the IP address and device model information of the device by const CVE-2019-96815.3Online upgrade information in some firmware packages of Dahua products is not encrypted. Attackers can obtain this information by analyzing CVE-2019-96828.1Dahua devices with Build time before December 2019 use strong security login mode by default, but in order to be compatible with the normal CVE-2019-96868.8pacman before 5.1.3 allows directory traversal when installing a remote package via a specified URL "pacman -U <url>" due to an unsanitized CVE-2019-96879.8PoDoFo 0.9.6 has a heap-based buffer overflow in PdfString::ConvertUTF16toUTF8 in base/PdfString.cpp.