CVE-2022-37393 Zimbra zmslapd arbitrary module load
A local attacker can escalate privileges to root by exploiting sudo permissions to load arbitrary shared objects via the zmslapd binary.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-37393?
CVE-2022-37393 is a high-severity vulnerability in Synacor Zimbra Server, published on 16 Aug 2022. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Zimbra's sudo configuration permits the zimbra user to execute the zmslapd binary as root with arbitrary parameters. As part of its intended functionality, zmslapd can load a user-defined configuration file, which includes plugins in the form of .so files, which also execute as root.
Weakness: CWE-284
Which versions are affected by CVE-2022-37393?
It affects 1 product.
Products include Zimbra Collaboration.
How do I fix CVE-2022-37393?
No fix has been published for CVE-2022-37393 yet. Limit exposure of the affected software until one is available.
Is CVE-2022-37393 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-37393 exists.
Public exploit code: 1 Metasploit module.
Other vulnerabilities in Synacor Zimbra Server
Sources
Also known as GHSA-8jjp-3pj6-xx8j.