CrowdSecLive Exploit Tracker
Limited ExploitationCVE-2019-9621Public Exploit

Zimbra - SSRF (CVE-2019-9621)

PublishedApr 30, 2019
First SeenN/A
Last Seen
Reported
CVSS7.5
Zimbra
ZimbraZimbra Collaboration Suite
mail

Description

Zimbra Collaboration Suite before 8.6 patch 13, 8.7.x before 8.7.11 patch 10, and 8.8.x before 8.8.10 patch 7 or 8.8.x before 8.8.11 patch 3 allows SSRF via the ProxyServlet component.

psychologyCrowdSec Analysis

CVE-2019-9621 is a server-side request forgery (SSRF) vulnerability in Zimbra Collaboration Suite versions prior to specific patches, which allows remote attackers to abuse the ProxyServlet component to make unauthorized requests to internal or external resources. This flaw could be exploited to access sensitive internal services or data, potentially leading to information disclosure or further attacks within the network.

CrowdSec has been tracking this vulnerability and its exploits since 15th of October 2025.

CrowdSec has not observed any significant exploitation activity targeting CVE-2019-9621 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.

Attackers exploit this vulnerability by sending crafted XML payloads to the /autodiscover endpoint, leveraging XXE to trigger SSRF and access internal files or services.

lock

Full Intelligence Available

Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.

EventDate
CVE Published2019-04-30
CISA KEV2025-07-07
CISA Remediation Deadline2025-07-28
Rule Released2025-10-15

Related Weaknesses

CWE-918: Server-Side Request Forgery (SSRF)

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

arrow_forward

Remediation & Protection

lock to download blocklists, subscribe to firewalls, and access IP intelligence.

External References