CVE-2024-45518

An issue was discovered in Zimbra Collaboration (ZCS) 10.1.x before 10.1.1, 10.0.x before 10.0.9, 9.0.0 before Patch 41, and 8.8.15 before Patch 46. It allows authenticated users to exploit Server-Side Request Forgery (SSRF) due to improper input sanitization and misconfigured domain whitelisting. This issue permits unauthorized HTTP requests to be sent to internal services, which can lead to Remote Code Execution (RCE) by chaining Command Injection within the internal service. When combined with existing XSS vulnerabilities, this SSRF issue can further facilitate Remote Code Execution (RCE).

• CWE-918
• CWE-918

• https://wiki.zimbra.com/wiki/Security_CenterRelease Notes
• https://wiki.zimbra.com/wiki/Zimbra_Releases/10.0.9#Security_FixesRelease Notes
• https://wiki.zimbra.com/wiki/Zimbra_Releases/10.1.1#Security_FixesRelease Notes
• https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.15/P46#Security_FixesRelease Notes
• https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P41#Security_FixesRelease Notes
• https://wiki.zimbra.com/wiki/Zimbra_Responsible_Disclosure_PolicyProduct
• https://wiki.zimbra.com/wiki/Zimbra_Security_AdvisoriesVendor Advisory

Published

Oct 22, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-45512An issue was discovered in webmail in Zimbra Collaboration (…5.4
• CVE-2024-45513An issue was discovered in Zimbra Collaboration (ZCS) throug…4.8
• CVE-2024-45514An issue was discovered in Zimbra Collaboration (ZCS) throug…5.4
• CVE-2024-45515An issue was discovered in Zimbra Collaboration (ZCS) throug…6.1
• CVE-2024-45516An issue was discovered in Zimbra Collaboration (ZCS) 9.0.0 …6.1
• CVE-2024-45517An issue was discovered in Zimbra Collaboration (ZCS) throug…5.4
• CVE-2024-45519The postjournal service in Zimbra Collaboration (ZCS) before…9.8
• CVE-2024-4552The Social Login Lite For WooCommerce plugin for WordPress i…9.8
• CVE-2024-45520WithSecure Atlant (formerly F-Secure Atlant) 1.0.35-1 allows…7.5
• CVE-2024-45522Linen before cd37c3e does not verify that the domain is line…9.8
• CVE-2024-45523An issue was discovered in Bravura Security Fabric versions …9.1
• CVE-2024-45526An issue was discovered in OPC Foundation OPCFoundation/UA-.…5.3