未評価
SQL injection vulnerability in the ZimbraSync Service SOAP endpoint in Zimbra Collaboration 10.0.x before 10.0.12 and 10.1.x before 10.1.4 due to insu...
CVE-2025-25064
SecPulse初出
原文の説明 取得元が公開している説明をそのまま載せています (多くは英語)。
SQL injection vulnerability in the ZimbraSync Service SOAP endpoint in Zimbra Collaboration 10.0.x before 10.0.12 and 10.1.x before 10.1.4 due to insufficient sanitization of a user-supplied parameter. Authenticated attackers can exploit this vulnerability by manipulating a specific parameter in the request, allowing them to inject arbitrary SQL queries that could retrieve email metadata.
参照URL
- advisory github.com
- advisory nvd.nist.gov
- web wiki.zimbra.com
- web wiki.zimbra.com
- web wiki.zimbra.com