CVE-2022-37393
Published: 16 August 2022
Summary
CVE-2022-37393 is a high-severity Improper Access Control (CWE-284) vulnerability in Zimbra Collaboration. Its CVSS base score is 7.8 (High).
Operationally, ranked in the top 9.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
Zimbra's sudo configuration permits the zimbra user to execute the zmslapd binary as root with arbitrary parameters. As part of its intended functionality, zmslapd can load a user-defined configuration file that includes plugins in the form of .so files, which also execute as root. The flaw affects Zimbra Collaboration Suite and is tracked under CVE-2022-37393 with a CVSS 3.1 score of 7.8.
A local attacker who already possesses the zimbra account can supply a malicious configuration and plugin to obtain root privileges on the host. Public proof-of-concept code and a Metasploit module implementing this technique have been released.
The associated EPSS score has remained flat at 0.0512 with no material rise after disclosure. Detailed technical analyses and exploit write-ups are available from Rapid7 and independent researchers, confirming that the issue has received attention in the security community.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-40027
Vulnerability details
Zimbra's sudo configuration permits the zimbra user to execute the zmslapd binary as root with arbitrary parameters. As part of its intended functionality, zmslapd can load a user-defined configuration file, which includes plugins in the form of .so files, which…
more
also execute as root.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
The access control policy and procedures directly mandate and enforce proper access control mechanisms across the organization.
Device lock enforces restricted access until re-authentication, directly reducing unauthorized use of active sessions.
Supervision and review of access control activities directly detects and remediates improper access configurations or usages.
Explicitly identifying and documenting actions permitted without identification or authentication enforces proper access control boundaries by defining justified exceptions.
By automatically labeling outputs with security attributes, the control supports attribute-based enforcement and reduces exploitability of improper access control weaknesses.
Associating and retaining security attributes with data directly supports enforcement of access control decisions across storage, processing, and transmission.
Requiring prior authorization for each remote access type prevents improper access control over remote connections.
Requiring authorization of wireless access before allowing connections enforces proper access control for this access method.