CVE-2022-37041: SSRF
An issue was discovered in ProxyServlet.java in the /proxy servlet in Zimbra Collaboration Suite (ZCS) 8.8.15 and 9.0. The value of the X-Forwarded-Host header overwrites the value of the Host header in proxied requests. The value of X-Forwarded-Host header is not checked against the whitelist of hosts that ZCS is allowed to proxy to (the zimbraProxyAllowedDomains setting).
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2022-37041?
CVE-2022-37041 is a vulnerability in Zimbra Collaboration Suite (ZCS) 8.8.15 and 9.0 that allows an attacker to overwrite the Host header in proxied requests.
How does CVE-2022-37041 affect Zimbra Collaboration Suite?
CVE-2022-37041 affects Zimbra Collaboration Suite versions 8.8.15 and 9.0 by allowing the X-Forwarded-Host header to overwrite the Host header in proxied requests.
What is the severity of CVE-2022-37041?
CVE-2022-37041 has a severity rating of 7.5 (high).
How can I fix CVE-2022-37041?
To fix CVE-2022-37041, update your Zimbra Collaboration Suite installation to a version that includes the necessary security patches.
Where can I find more information about CVE-2022-37041?
You can find more information about CVE-2022-37041 on the Zimbra Security Center and Zimbra Security Advisories pages.