{"id":"CVE-2024-45519","kind":"vulnerability","aliases":["CVE-2024-45519"],"related":[],"title":"synacor zimbra collaboration suite: The postjournal service in Zimbra Collaboration (ZCS) before 8.8.15 Patch 46, 9 before 9.0.0 Patch 41, 10 before…","description":"Synacor Zimbra Collaboration Suite (ZCS) contains an unspecified vulnerability in the postjournal service that may allow an unauthenticated user to execute commands.\n\nCISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","summary":"Zimbra Collaboration Suite has an unspecified flaw in its postjournal service that lets an unauthenticated user run commands. CISA lists it as actively exploited in the wild.","severity":"critical","cvss":10.0,"epss":null,"exploited":true,"exploited_at":"2024-10-03T00:00:00+00:00","products":[{"name":"Synacor Zimbra Collaboration Suite (ZCS)","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"synacor zimbra collaboration suite","fixed":["8.8.15"],"affected":"< 8.8.15","ecosystem":"vendor"},{"name":"synacor zimbra collaboration suite","fixed":["10.0.9"],"affected":">= 10.0.0, < 10.0.9","ecosystem":"vendor"},{"name":"synacor zimbra collaboration suite","fixed":[],"affected":"= 8.8.15","ecosystem":"vendor"},{"name":"synacor zimbra collaboration suite","fixed":[],"affected":"= 9.0.0","ecosystem":"vendor"},{"name":"synacor zimbra collaboration suite","fixed":[],"affected":"= 10.1.0","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","mail-server","package","self-hosted","zimbra"],"not_affected_if":["managed-hosting"],"how_to_check":null,"fix":"Apply the vendor mitigation per Synacor/Zimbra instructions, or stop using the product if no mitigation exists (per CISA required action).","status":"open","published_at":"2024-10-02T22:15:02+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:56:31+00:00","updated_at":"2026-10-23T22:29:05+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-23T20:56:31Z","model":"claude-haiku-5-5","output":{"fix":"Apply the vendor mitigation per Synacor/Zimbra instructions, or stop using the product if no mitigation exists (per CISA required action).","reach":"network","impact":"high","summary":"Zimbra Collaboration Suite has an unspecified flaw in its postjournal service that lets an unauthenticated user run commands. CISA lists it as actively exploited in the wild.","category":"package","who_cares":["zimbra","self-hosted","mail-server"],"confidence":0.7,"needs_auth":"no","worst_case":"unauthenticated attacker runs commands on the mail server","analyst_note":"Find the vendor advisory and the affected/fixed Zimbra versions and the postjournal mitigation steps; the sources give no version or check command.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["managed-hosting"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000454,"input_tokens":2860,"output_tokens":335,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2024':23A,26A '-45519':24A,27A '10':21A '41':20A '46':15A '8.8.15':13A '9':16A '9.0.0':18A 'action':113C 'activ':84B 'allow':104C 'appli':114C 'cisa':80B,111C 'collabor':3A,10A,63B,91C 'collaboration':30A,35A,39A,43A,47A,51A 'command':79B,110C 'contain':94C 'cve':22A,25A 'discontinu':120C 'execut':109C 'exploit':53B,85B 'flaw':68B 'host':60B 'instruct':118C 'let':74B 'list':81B 'mail':55B 'mail-serv':54B 'may':103C 'mitig':115C,126C 'packag':57B 'patch':14A,19A 'per':116C 'postjourn':6A,71B,100C 'product':124C 'requir':112C 'run':78B 'self':59B 'self-host':58B 'server':56B 'servic':7A,72B,101C 'suit':4A,64B,92C 'suite':31A,36A,40A,44A,48A,52A 'synacor':1A,28A,33A,37A,41A,45A,49A,89C 'unauthent':76B,106C 'unavail':128C 'unspecifi':67B,96C 'use':121C 'user':77B,107C 'vendor':117C 'vulner':97C 'wild':88B 'zcs':11A,32A,93C 'zimbra':2A,9A,29A,34A,38A,42A,46A,50A,61B,62B,90C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2024-10-02T22:15:02+00:00","kev":{"dateAdded":"2024-10-03","dueDate":"2024-10-24","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cvss_by":"cve@mitre.org","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2024-45519","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-45519","severity":null,"published_at":"2024-10-03T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T16:39:46+00:00","note":null},{"source":"nvd","external_id":"CVE-2024-45519","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-45519","severity":null,"published_at":"2024-10-02T22:15:02+00:00","modified_at":"2026-06-17T07:54:22+00:00","first_seen_at":"2026-10-23T22:29:05+00:00","fetched_at":"2026-10-23T22:29:05+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}