Zimbra Collaboration Suite before 8.6 patch 13, 8.7.x before 8.7.11 patch 10, and 8.8.x before 8.8.10 patch 7 or 8.8.x before 8.8.11 patch 3 allows SSRF via the ProxyServlet component.
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Collaboration_server | Zimbra | * | 8.6.0 (excluding) |
| Collaboration_server | Zimbra | 8.7.0 (including) | 8.7.11 (excluding) |
| Collaboration_server | Zimbra | 8.8.0 (including) | 8.8.10 (excluding) |
| Collaboration_server | Zimbra | 8.6.0 (including) | 8.6.0 (including) |
| Collaboration_server | Zimbra | 8.6.0-p1 (including) | 8.6.0-p1 (including) |
| Collaboration_server | Zimbra | 8.6.0-p10 (including) | 8.6.0-p10 (including) |
| Collaboration_server | Zimbra | 8.6.0-p11 (including) | 8.6.0-p11 (including) |
| Collaboration_server | Zimbra | 8.6.0-p12 (including) | 8.6.0-p12 (including) |
| Collaboration_server | Zimbra | 8.6.0-p2 (including) | 8.6.0-p2 (including) |
| Collaboration_server | Zimbra | 8.6.0-p3 (including) | 8.6.0-p3 (including) |
| Collaboration_server | Zimbra | 8.6.0-p4 (including) | 8.6.0-p4 (including) |
| Collaboration_server | Zimbra | 8.6.0-p5 (including) | 8.6.0-p5 (including) |
| Collaboration_server | Zimbra | 8.6.0-p6 (including) | 8.6.0-p6 (including) |
| Collaboration_server | Zimbra | 8.6.0-p7 (including) | 8.6.0-p7 (including) |
| Collaboration_server | Zimbra | 8.6.0-p8 (including) | 8.6.0-p8 (including) |
| Collaboration_server | Zimbra | 8.6.0-p9 (including) | 8.6.0-p9 (including) |
| Collaboration_server | Zimbra | 8.7.11 (including) | 8.7.11 (including) |
| Collaboration_server | Zimbra | 8.7.11-p1 (including) | 8.7.11-p1 (including) |
| Collaboration_server | Zimbra | 8.7.11-p2 (including) | 8.7.11-p2 (including) |
| Collaboration_server | Zimbra | 8.7.11-p3 (including) | 8.7.11-p3 (including) |
| Collaboration_server | Zimbra | 8.7.11-p4 (including) | 8.7.11-p4 (including) |
| Collaboration_server | Zimbra | 8.7.11-p5 (including) | 8.7.11-p5 (including) |
| Collaboration_server | Zimbra | 8.7.11-p6 (including) | 8.7.11-p6 (including) |
| Collaboration_server | Zimbra | 8.7.11-p7 (including) | 8.7.11-p7 (including) |
| Collaboration_server | Zimbra | 8.7.11-p8 (including) | 8.7.11-p8 (including) |
| Collaboration_server | Zimbra | 8.7.11-p9 (including) | 8.7.11-p9 (including) |
| Collaboration_server | Zimbra | 8.8.10 (including) | 8.8.10 (including) |
| Collaboration_server | Zimbra | 8.8.10-p1 (including) | 8.8.10-p1 (including) |
| Collaboration_server | Zimbra | 8.8.10-p2 (including) | 8.8.10-p2 (including) |
| Collaboration_server | Zimbra | 8.8.10-p3 (including) | 8.8.10-p3 (including) |
| Collaboration_server | Zimbra | 8.8.10-p4 (including) | 8.8.10-p4 (including) |
| Collaboration_server | Zimbra | 8.8.10-p5 (including) | 8.8.10-p5 (including) |
| Collaboration_server | Zimbra | 8.8.10-p6 (including) | 8.8.10-p6 (including) |
| Collaboration_server | Zimbra | 8.8.11 (including) | 8.8.11 (including) |
| Collaboration_server | Zimbra | 8.8.11-p1 (including) | 8.8.11-p1 (including) |
| Collaboration_server | Zimbra | 8.8.11-p2 (including) | 8.8.11-p2 (including) |