Lucene search
MitreCVELIST:CVE-2021-35209HistoryJul 02, 2021 - 6:54 p.m.
CVE-2021-35209
2021-07-0218:54:43
mitre
www.cve.org
1
An issue was discovered in ProxyServlet.java in the /proxy servlet in Zimbra Collaboration Suite 8.8 before 8.8.15 Patch 23 and 9.x before 9.0.0 Patch 16. The value of the X-Host header overwrites the value of the Host header in proxied requests. The value of X-Host header is not checked against the whitelist of hosts Zimbra is allowed to proxy to (the zimbraProxyAllowedDomains setting).
Related
cve
cve
CVE-2021-35209
2021-07-02 19:15:08
prion
prion
Design/Logic Flaw
2021-07-02 19:15:00
nvd
nvd
CVE-2021-35209
2021-07-02 19:15:08
osv
osv
CVE-2021-35209
2021-07-02 19:15:08
thn
thn
New Bug Could Let Attackers Hijack Zimbra Server by Sending Malicious Email
2021-07-27 15:46:00
sonarsource
sonarsource
Zimbra 8.8.15 - Webmail Compromise via Email
2021-07-27 00:00:00
avleonov
avleonov
threatpost
threatpost
Zimbra Server Bugs Could Lead to Email Plundering
2021-07-27 17:30:28
nessus
nessus