CVE-2022-41347

An issue was discovered in Zimbra Collaboration (ZCS) 8.8.x and 9.x (e.g., 8.8.15). The Sudo configuration permits the zimbra user to execute the NGINX binary as root with arbitrary parameters. As part of its intended functionality, NGINX can load a user-defined configuration file, which includes plugins in the form of .so files, which also execute as root.

• https://darrenmartyn.ie/2021/10/25/zimbra-nginx-local-root-exploit/Exploit, Third Party Advisory
• https://github.com/darrenmartyn/zimbra-hinginxThird Party Advisory
• https://wiki.zimbra.com/wiki/Security_CenterPatch, Vendor Advisory
• https://wiki.zimbra.com/wiki/Zimbra_Security_AdvisoriesVendor Advisory
• https://darrenmartyn.ie/2021/10/25/zimbra-nginx-local-root-exploit/Exploit, Third Party Advisory
• https://github.com/darrenmartyn/zimbra-hinginxThird Party Advisory
• https://wiki.zimbra.com/wiki/Security_CenterPatch, Vendor Advisory
• https://wiki.zimbra.com/wiki/Zimbra_Security_AdvisoriesVendor Advisory

Published

Sep 26, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-41339In Zoho ManageEngine Mobile Device Manager Plus before 10.1.…7.8
• CVE-2022-4134A flaw was found in openstack-glance. This issue could allow…2.8
• CVE-2022-41340The secp256k1-js package before 1.1.0 for Node.js implements…7.5
• CVE-2022-41341Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2022-41342Improper buffer restrictions in the Intel(R) C++ Compiler Cl…7.8
• CVE-2022-41343registerFont in FontMetrics.php in Dompdf before 2.0.1 allow…7.5
• CVE-2022-41348An issue was discovered in Zimbra Collaboration (ZCS) 9.0. X…6.1
• CVE-2022-41349In Zimbra Collaboration Suite (ZCS) 8.8.15, the URL at /h/co…6.1
• CVE-2022-4135Heap buffer overflow in GPU in Google Chrome prior to 107.0.…9.6
• CVE-2022-41350In Zimbra Collaboration Suite (ZCS) 8.8.15, /h/search?action…6.1
• CVE-2022-41351In Zimbra Collaboration Suite (ZCS) 8.8.15, at the URL /h/ca…6.1
• CVE-2022-41352An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15…9.8