Zimbra Collaboration XML External Entity Vulnerability in Exchange Web Services

An XML External Entity (XXE) vulnerability has been identified in the Zimbra Collaboration (ZCS) versions 10.0 and 10.1. This issue resides within the Exchange Web Services (EWS) SOAP interface, where XML input is not properly sanitized. As a result, an authenticated attacker can send crafted XML that is processed by an XML parser with external entity resolution enabled. Exploiting this vulnerability could lead to the unauthorized disclosure of sensitive local files from the server.

Impact

Successful exploitation allows for the disclosure of sensitive local files from the server.

Remediation

Users can upgrade to ZCS version 10.1.16, which addresses this vulnerability. Instructions for upgrading are available on the Zimbra website.