CVE-2024-54663

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-54663
An issue was discovered in the Webmail Classic UI in Zimbra Collaboration (ZCS) 9.0 and 10.0 and 10.1. A Local File Inclusion (LFI) vulnerability exists in the /h/rest endpoint, allowing authenticated remote attackers to include and access sensitive files in the WebRoot directory. Exploitation requires a valid auth token and involves crafting a malicious request targeting specific file paths.

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://wiki.zimbra.com/wiki/Zimbra_Releases/10.0.11#Security_Fixes Release Notes
https://wiki.zimbra.com/wiki/Zimbra_Releases/10.1.3#Security_Fixes Release Notes
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:synacor:zimbra_collaboration_suite:*:*:*:*:*:*:*:*
cpe:2.3:a:synacor:zimbra_collaboration_suite:*:*:*:*:*:*:*:*
History

11 Jun 2025, 21:17

Type Values Removed Values Added
CPE cpe:2.3:a:synacor:zimbra_collaboration_suite:*:*:*:*:*:*:*:*
References () https://wiki.zimbra.com/wiki/Zimbra_Releases/10.0.11#Security_Fixes - () https://wiki.zimbra.com/wiki/Zimbra_Releases/10.0.11#Security_Fixes - Release Notes
References () https://wiki.zimbra.com/wiki/Zimbra_Releases/10.1.3#Security_Fixes - () https://wiki.zimbra.com/wiki/Zimbra_Releases/10.1.3#Security_Fixes - Release Notes
First Time Synacor
Synacor zimbra Collaboration Suite

31 Dec 2024, 19:15

Type Values Removed Values Added
Summary
  • (es) Se descubrió un problema en Webmail Classic UI en Zimbra Collaboration (ZCS) 9.0, 10.0 y 10.1. Existe una vulnerabilidad de inclusión de archivos locales (LFI) en el endpoint /h/rest, que permite a atacantes remotos autenticados incluir y acceder a archivos confidenciales en el directorio WebRoot. La explotación requiere un token de autenticación válido e implica la manipulación de una solicitud maliciosa dirigida a rutas de archivos específicas.
CWE CWE-829
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.5

19 Dec 2024, 23:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-12-19 23:15

Updated : 2025-06-11 21:17

NVD link : CVE-2024-54663

Mitre link : CVE-2024-54663

CVE.ORG link : CVE-2024-54663

JSON object : View

Products Affected

synacor

  • zimbra_collaboration_suite
CWE
CWE-829

Inclusion of Functionality from Untrusted Control Sphere