Zimbra Collaboration Server-Side Request Forgery Vulnerability in Chat Proxy Configuration

A server-side request forgery (SSRF) vulnerability has been identified in Zimbra Collaboration (ZCS) versions prior to 10.1.12. The vulnerability arises from the chat proxy configuration, allowing unauthorized requests to internal services.

Impact

Exploitation of this vulnerability allows for server-side request forgery, where an attacker can make the server send requests to internal services or resources, potentially leading to unauthorized access or information disclosure.

Remediation

Users are advised to upgrade to Zimbra Collaboration version 10.1.12, which addresses this vulnerability. Instructions for upgrading can be found on the Zimbra Wiki.