CVE-2022-37393

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

Zimbra's sudo configuration permits the zimbra user to execute the zmslapd binary as root with arbitrary parameters. As part of its intended functionality, zmslapd can load a user-defined configuration file, which includes plugins in the form of .so files, which also execute as root.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-284

Affected software

Vendor	Product	Versions
Synacor	Zimbra Server	>= 9.0.0.p27, <= 9.0.0.p27; >= 8.8.15.p34, <= 8.8.15.p34

References

https://attackerkb.com/topics/92AeLOE1M1/cve-2022-37393/rapid7-analysisExploit, Third Party Advisory
https://darrenmartyn.ie/2021/10/27/zimbra-zmslapd-local-root-exploit/Exploit, Third Party Advisory
https://github.com/rapid7/metasploit-framework/pull/16807Exploit, Patch, Third Party Advisory
https://attackerkb.com/topics/92AeLOE1M1/cve-2022-37393/rapid7-analysisExploit, Third Party Advisory
https://darrenmartyn.ie/2021/10/27/zimbra-zmslapd-local-root-exploit/Exploit, Third Party Advisory
https://github.com/rapid7/metasploit-framework/pull/16807Exploit, Patch, Third Party Advisory

Timeline

Published: Aug 16, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-373943.3An issue was discovered in OpenStack Nova before 23.2.2, 24.x before 24.1.2, and 25.x before 25.0.2. By creating a neutron port with the dir CVE-2022-373957.5A Huawei device has an input verification vulnerability. Successful exploitation of this vulnerability may lead to DoS attacks.Affected prod CVE-2022-373967.8In JetBrains Rider before 2022.2 Trust and Open Project dialog could be bypassed, leading to local code execution CVE-2022-373979.8An issue was discovered in the YugabyteDB 2.6.1 when using LDAP-based authentication in YCQL with Microsoft’s Active Directory. When anonymo CVE-2022-373988.8A stack-based buffer overflow vulnerability was found inside ADM when using WebDAV due to the lack of data size validation. An attacker can CVE-2022-37404.9An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.9 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior CVE-2022-374008.8Apache OpenOffice supports the storage of passwords for web connections in the user's configuration database. The stored passwords are encry CVE-2022-374018.8Apache OpenOffice supports the storage of passwords for web connections in the user's configuration database. The stored passwords are encry CVE-2022-374024.8Stored Cross-site Scripting (XSS) vulnerability in AFS Analytics plugin <= 4.18 versions.CVE-2022-374034.8Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Nikhil Vaghela's Add User Role plugin <= 0.0.1 at WordPress.CVE-2022-374044.8Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Christian Salazar's add2fav plugin <= 1.0 at WordPress.CVE-2022-374058.8Cross-Site Request Forgery (CSRF) vulnerability in Mickey Kay's Better Font Awesome plugin <= 2.0.1 at WordPress.