{
  "crds_version": "0.1",
  "kind": "base",
  "id": "crds:cve-2022-37042",
  "revision": 1,
  "title": "Zimbra Collaboration — mboximport Authentication Bypass to RCE",
  "summary": "The mboximport function in Zimbra Collaboration 8.8.15 and 9.0 can be reached without authentication, so an attacker can upload an archive whose files land anywhere on the system, leading to RCE. It stems from an incomplete fix for CVE-2022-27925.",
  "source_type": "cve",
  "severity": "critical",
  "cvss": {
    "score": 9.8,
    "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
    "version": "3.1"
  },
  "epss": 0.92072,
  "exploitation": {
    "known_exploited": true,
    "exploit_available": true,
    "attack_complexity": "low",
    "kev_added": "2022-08-11",
    "kev_due": "2022-09-01",
    "prerequisites": "Network access to the Zimbra server. No authentication token is needed."
  },
  "mitre_attack": [
    "T1190"
  ],
  "kill_chain": "initial_access",
  "recommended_action": "Apply the fix from Zimbra's security advisories to every 8.8.15 and 9.0 server.",
  "confidence": "high",
  "provenance": [
    {
      "fields": [
        "cvss",
        "exploitation.attack_complexity",
        "exploitation.exploit_available",
        "published_at",
        "references"
      ],
      "source": "https://nvd.nist.gov/vuln/detail/CVE-2022-37042",
      "retrieved_at": "2026-11-05T08:18:20.755Z",
      "confidence": "high",
      "extractor": "scrty-crds-pipeline/0.1"
    },
    {
      "fields": [
        "exploitation.known_exploited",
        "exploitation.kev_added",
        "exploitation.kev_due"
      ],
      "source": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "retrieved_at": "2026-11-05T08:18:20.755Z",
      "confidence": "high",
      "extractor": "scrty-crds-pipeline/0.1"
    },
    {
      "fields": [
        "epss"
      ],
      "source": "https://api.first.org/data/v1/epss?cve=CVE-2022-37042",
      "retrieved_at": "2026-11-05T08:18:20.755Z",
      "confidence": "high",
      "extractor": "scrty-crds-pipeline/0.1"
    },
    {
      "fields": [
        "title",
        "subtitle",
        "summary",
        "severity",
        "remediation",
        "mitre_attack",
        "kill_chain",
        "recommended_action",
        "confidence",
        "tags",
        "exploitation.prerequisites"
      ],
      "source": "https://nvd.nist.gov/vuln/detail/CVE-2022-37042",
      "retrieved_at": "2026-11-05T08:18:20.755Z",
      "confidence": "high",
      "extractor": "claude-code"
    }
  ],
  "references": [
    {
      "type": "cve",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-37042",
      "label": "NVD record"
    },
    {
      "type": "cisa",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "label": "CISA Known Exploited Vulnerabilities catalog"
    },
    {
      "type": "vendor_advisory",
      "url": "https://wiki.zimbra.com/wiki/Security_Center"
    },
    {
      "type": "vendor_advisory",
      "url": "https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories"
    },
    {
      "type": "exploit",
      "url": "http://packetstormsecurity.com/files/168146/Zimbra-Zip-Path-Traversal.html"
    }
  ],
  "published_at": "2022-08-12T15:15:16.053Z",
  "issued_at": "2026-11-05T08:18:20.755Z",
  "tags": [
    "zimbra",
    "authentication-bypass",
    "path-traversal",
    "ransomware"
  ]
}