Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2020-7796: Zimbra Collaboration Suite could be tricked into external requests
CVE-2020-7796 · published 6 years ago · actively exploited
Summary
If the WebEx add‑on (zimlet) is installed and its JSP feature is left turned on, Zimbra Collaboration Suite can be made to send requests to any address the attacker chooses. This may let an attacker reach internal services or gather data from other systems. Remove the WebEx zimlet or disable its JSP component until a patch is applied.
What to do
- Update synacor zimbra_collaboration_suite to version 8.8.15 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| synacor | zimbra collaboration suite | All versions |
| synacor | zimbra_collaboration_suite |
< 8.8.15 8.8.15 cpe:2.3:a:synacor:zimbra_collaboration_suite:*:*:*:*:*:*:*:* |
Original advisory text
Synacor Zimbra Collaboration Suite (ZCS) Server-Side Request Forgery Vulnerability
Synacor Zimbra Collaboration Suite (ZCS) contains a server-side request forgery vulnerability if WebEx zimlet installed and zimlet JSP is enabled.
Internet-facing
3 days
and check for signs of compromise
Internal
3 days
and check for signs of compromise
- Known to be exploited
- Can be exploited automatically
- Gives an attacker full control
Known exploited
Listed in the CISA KEV catalogue - exploitation confirmed in the wild.
94%
chance of attack within 30 days
Type
CWE-918Server-Side Request Forgery (SSRF)
Timeline
Published18 Feb 2020
Updated26 Oct 2026
First seen6 Mar 2026
Track software like this
Free during beta