{"id":"CVE-2020-7796","kind":"vulnerability","aliases":["CVE-2020-7796"],"related":[],"title":"synacor zimbra collaboration suite: Zimbra Collaboration Suite (ZCS) before 8.8.15 Patch 7 allows SSRF when WebEx zimlet is installed and zimlet JSP is…","description":"Synacor Zimbra Collaboration Suite (ZCS) contains a server-side request forgery vulnerability if WebEx zimlet installed and zimlet JSP is enabled.\n\nCISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","summary":"Zimbra Collaboration Suite has a server-side request forgery flaw in its WebEx zimlet when the zimlet JSP is enabled. An attacker can make the Zimbra server send requests to hosts it can reach, such as internal services, and CISA lists it as actively exploited.","severity":"critical","cvss":9.8,"epss":null,"exploited":true,"exploited_at":"2026-02-17T00:00:00+00:00","products":[{"name":"synacor zimbra collaboration suite","fixed":["8.8.15"],"affected":"< 8.8.15","ecosystem":"vendor"},{"name":"synacor zimbra collaboration suite","fixed":[],"affected":"= 8.8.15","ecosystem":"vendor"},{"name":"Synacor Zimbra Collaboration Suite","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["email","exploited","package","self-hosted","zimbra"],"not_affected_if":["webex-zimlet-not-installed","zimlet-jsp-disabled"],"how_to_check":null,"fix":"Apply the vendor mitigations per CISA guidance; the specific patched version is unknown from the sources.\nIf mitigations are unavailable, discontinue use of the product per CISA required action.","status":"open","published_at":"2020-02-18T22:15:10+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:42:17+00:00","updated_at":"2026-10-24T00:09:50+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-23T20:42:17Z","model":"claude-haiku-5-5","output":{"fix":"Apply the vendor mitigations per CISA guidance; the specific patched version is unknown from the sources.\nIf mitigations are unavailable, discontinue use of the product per CISA required action.","reach":"internet","summary":"Zimbra Collaboration Suite has a server-side request forgery flaw in its WebEx zimlet when the zimlet JSP is enabled. An attacker can make the Zimbra server send requests to hosts it can reach, such as internal services, and CISA lists it as actively exploited.","category":"package","who_cares":["zimbra","self-hosted","email"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker makes the mail server fetch internal URLs and reach hosts behind the firewall.","analyst_note":"Find the vendor advisory and the fixed Zimbra version and the exact zimlet JSP path to check; the sources only give the CISA KEV entry.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["webex-zimlet-not-installed","zimlet-jsp-disabled"],"user_interaction":"unknown","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000464,"input_tokens":2575,"output_tokens":412,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-01':128C '-2020':24A,27A '-7796':25A,28A '22':127C '7':12A '8.8.15':10A 'action':118C 'activ':92B 'allow':13A 'appli':119C 'applic':125C 'attack':70B 'bod':126C 'cisa':88B,116C 'cloud':131C 'collabor':3A,6A,49B,96C 'collaboration':31A,35A,39A 'contain':99C 'cve':23A,26A 'discontinu':134C 'email':41B 'enabl':68B,115C 'exploit':42B,93B 'flaw':58B 'follow':124C 'forgeri':57B,105C 'guidanc':129C 'host':46B,79B 'instal':19A,110C 'instruct':123C 'intern':85B 'jsp':22A,66B,113C 'list':89B 'make':72B 'mitig':120C,140C 'packag':43B 'patch':11A 'per':121C 'product':138C 'reach':82B 'request':56B,77B,104C 'requir':117C 'self':45B 'self-host':44B 'send':76B 'server':54B,75B,102C 'server-sid':53B,101C 'servic':86B,132C 'side':55B,103C 'ssrf':14A 'suit':4A,7A,50B,97C 'suite':32A,36A,40A 'synacor':1A,29A,33A,37A,94C 'unavail':142C 'use':135C 'vendor':122C 'vulner':106C 'webex':16A,61B,108C 'zcs':8A,98C 'zimbra':2A,5A,30A,34A,38A,47B,48B,74B,95C 'zimlet':17A,21A,62B,65B,109C,112C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2020-02-18T22:15:10+00:00","kev":{"dateAdded":"2026-02-17","dueDate":"2026-03-10","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2020-7796","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-7796","severity":null,"published_at":"2026-02-17T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T15:39:40+00:00","note":null},{"source":"nvd","external_id":"CVE-2020-7796","url":"https://nvd.nist.gov/vuln/detail/CVE-2020-7796","severity":null,"published_at":"2020-02-18T22:15:10+00:00","modified_at":"2026-06-17T03:25:27+00:00","first_seen_at":"2026-10-23T23:44:51+00:00","fetched_at":"2026-10-23T23:44:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}