CyberRota Analysis
AI-GeneratedThe Zimbra Classic Web Client prior to version 10.1.17 is vulnerable to a local file inclusion (LFI) flaw due to insufficient validation of the 'fu' request parameter. An unauthenticated attacker can exploit this vulnerability to disclose sensitive files, potentially exposing critical configuration data. Organizations using affected versions of Zimbra should prioritize patching to mitigate the risk of unauthorized data exposure.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
In Zimbra Collaboration before 10.1.17, a local file inclusion (LFI) vulnerability exists in the Zimbra Classic Web Client due to improper validation of the fu request parameter. An unauthenticated attacker can exploit this vulnerability by supplying a crafted path, potentially allowing unauthorized disclosure of protected files, such as WEB-INF/web.xml, within the web application directory. This occurs in the Forward servlet.