Attackers can send unauthorized requests to internal services that are normally protected by firewalls.
In some scenarios, it may be possible to steal login credentials or inject malware through chained exploits. Current Threat Status cve20207796 zimbra collaboration suite full
Actively monitor application logs for anomalous requests to internal services or suspicious DNS queries. cve20207796 zimbra collaboration suite full
The vulnerability is specifically linked to the WebEx Zimlet ( com_zimbra_webex ) when the Zimlet JSP functionality is enabled. cve20207796 zimbra collaboration suite full
Attackers use SSRF to probe and map out an organization’s internal network architecture.
Upgrade to Zimbra Collaboration 8.8.15 Patch 7 or later . This version contains the necessary security fixes for this SSRF flaw.
Implement network-level restrictions to limit the Zimbra server’s outbound connections only to trusted destinations.