CVE-2019-9621:

CVE-2019-9621: SSRF vulnerability in Zimbra Collaboration Suite via the ProxyServlet component, affecting several releases prior to the patched versions.

Score
A numerical rating that indicates how dangerous this vulnerability is.

7.5High

Published Date:Apr 30, 2019
CISA KEV Date:Jul 7, 2025
Industries Affected:20

Armis Early Warning:

2260 Days

Threat Predictions

EPSS Score:94.1
EPSS Percentile:100%

Exploitability

Score:3.9
Attack Vector:NETWORK
Attack Complexity:LOW
Privileges Required:NONE
User Interaction:NONE
Scope:UNCHANGED

Impact

Score:3.6
Confidentiality Impact:HIGH
Integrity Impact:NONE
Availability Impact:NONE

Description Preview

CVE-2019-9621: SSRF vulnerability in Zimbra Collaboration Suite via the ProxyServlet component, affecting several releases prior to the patched versions.

Overview

This CVE describes an SSRF flaw in the Zimbra ProxyServlet that could allow an attacker to coax the Zimbra server into making arbitrary requests, potentially probing internal services or exfiltrating data. The issue affects legacy releases and is mitigated by applying the vendor-provided patches to reach the fixed versions (8.6 patch 13, 8.7.x up to 8.7.11 patch 10, or 8.8.x up to 8.8.10 patch 7, and 8.8.x up to 8.8.11 patch 3 or newer). Public references include Zimbra advisories, Bugzilla entries, and external writeups describing the vulnerability and related exploitation material.

Remediation

Upgrade to a patched release per the advisory: move to Zimbra 8.6 patch 13 or newer, 8.7.x to 8.7.11 patch 10 or newer, or 8.8.x to 8.8.10 patch 7 or newer (and 8.8.11 patch 3 or newer).
After upgrading, verify the install reflects the patched version and run compatibility and functionality tests in a staging environment before production redeployment.
Review Zimbra security advisories and apply any additional hardening recommendations provided by the vendor.
Run vulnerability scans and monitor logs for ProxyServlet access patterns to confirm the patch is effective and no SSRF activity is present.
If immediate patching is not feasible, apply compensating network controls to limit exposure to the ProxyServlet endpoint (e.g., restrict access to trusted networks) and plan a timely upgrade.