CVE-2023-24032

HIGH

Zimbra Collaboration Suite <9.0-8.8.15 - Privilege Escalation

Title source: llm

Description

In Zimbra Collaboration Suite through 9.0 and 8.8.15, an attacker (who has initial user access to a Zimbra server instance) can execute commands as root by passing one of JVM arguments, leading to local privilege escalation (LPE).

References (2)

Core 2

Core References

Patch, Release Notes

https://wiki.zimbra.com/wiki/Security_Center

Vendor Advisory

https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories

Scores

CVSS v3 7.8

EPSS 0.0096

EPSS Percentile 57.0%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact total

Details

CWE

CWE-77

Status published

Products (2)

zimbra/collaboration 8.8.15 (36 CPE variants)

zimbra/collaboration 9.0.0 (14 CPE variants)

Published Jun 15, 2023

Tracked Since Feb 18, 2026