CVE-2023-24032: Command Injection
Published Jun 15, 2023
·Updated
In Zimbra Collaboration Suite through 9.0 and 8.8.15, an attacker (who has initial user access to a Zimbra server instance) can execute commands as root by passing one of JVM arguments, leading to local privilege escalation (LPE).
Affected Software
60 affected components
Zimbra Collaboration=8.8.15
Zimbra Collaboration=8.8.15-p1
Zimbra Collaboration=8.8.15-p10
Zimbra Collaboration=8.8.15-p11
Zimbra Collaboration=8.8.15-p12
Zimbra Collaboration=8.8.15-p13
Zimbra Collaboration=8.8.15-p14
Zimbra Collaboration=8.8.15-p15
Zimbra Collaboration=8.8.15-p16
Zimbra Collaboration=8.8.15-p17
Zimbra Collaboration=8.8.15-p18
Zimbra Collaboration=8.8.15-p19
Zimbra Collaboration=8.8.15-p2
Zimbra Collaboration=8.8.15-p20
Zimbra Collaboration=8.8.15-p21
Zimbra Collaboration=8.8.15-p22
Zimbra Collaboration=8.8.15-p23
Zimbra Collaboration=8.8.15-p24
Zimbra Collaboration=8.8.15-p25
Zimbra Collaboration=8.8.15-p26
Zimbra Collaboration=8.8.15-p27
Zimbra Collaboration=8.8.15-p28
Zimbra Collaboration=8.8.15-p29
Zimbra Collaboration=8.8.15-p3
Zimbra Collaboration=8.8.15-p30
Zimbra Collaboration=8.8.15-p31
Zimbra Collaboration=8.8.15-p32
Zimbra Collaboration=8.8.15-p33
Zimbra Collaboration=8.8.15-p34
Zimbra Collaboration=8.8.15-p35
Zimbra Collaboration=8.8.15-p4
Zimbra Collaboration=8.8.15-p5
Zimbra Collaboration=8.8.15-p6
Zimbra Collaboration=8.8.15-p7
Zimbra Collaboration=8.8.15-p8
Zimbra Collaboration=8.8.15-p9
Zimbra Collaboration=9.0.0
Zimbra Collaboration=9.0.0-p0
Zimbra Collaboration=9.0.0-p1
Zimbra Collaboration=9.0.0-p10
Zimbra Collaboration=9.0.0-p11
Zimbra Collaboration=9.0.0-p12
Zimbra Collaboration=9.0.0-p13
Zimbra Collaboration=9.0.0-p14
Zimbra Collaboration=9.0.0-p15
Zimbra Collaboration=9.0.0-p19
Zimbra Collaboration=9.0.0-p2
Zimbra Collaboration=9.0.0-p23
Zimbra Collaboration=9.0.0-p25
Zimbra Collaboration=9.0.0-p26
Zimbra Collaboration=9.0.0-p27
Zimbra Collaboration=9.0.0-p3
Zimbra Collaboration=9.0.0-p33
Zimbra Collaboration=9.0.0-p4
Zimbra Collaboration=9.0.0-p5
Zimbra Collaboration=9.0.0-p6
Zimbra Collaboration=9.0.0-p7
Zimbra Collaboration=9.0.0-p7.1
Zimbra Collaboration=9.0.0-p8
Zimbra Collaboration=9.0.0-p9
Remediation
Patch Available
Event History
Jun 15, 2023
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2023-24032?
CVE-2023-24032 has a high severity level due to its potential for local privilege escalation.
2
How do I fix CVE-2023-24032?
To fix CVE-2023-24032, update your Zimbra Collaboration Suite to the latest patched version as recommended by Zimbra.
3
Who is affected by CVE-2023-24032?
CVE-2023-24032 affects users who have initial access to Zimbra Collaboration Suite versions 8.8.15 and 9.0.0.
4
What does CVE-2023-24032 exploit?
CVE-2023-24032 exploits vulnerable JVM arguments to allow attackers to execute commands as root.
5
When was CVE-2023-24032 reported?
CVE-2023-24032 was reported in March 2023.