{"id":"CVE-2022-3569","details":"Due to an issue with incorrect sudo permissions, Zimbra Collaboration Suite (ZCS) suffers from a local privilege escalation issue in versions 9.0.0 and prior, where the 'zimbra' user can effectively coerce postfix into running arbitrary commands as 'root'.","modified":"2026-09-14T03:45:19.774930051Z","published":"2022-10-17T22:45:11.553Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/3xxx/CVE-2022-3569.json","unresolved_ranges":[{"extracted_events":[{"introduced":"9.0.0"},{"last_affected":"9.0.0"}],"source":"AFFECTED_FIELD"}],"cna_assigner":"rapid7","cwe_ids":["CWE-271"]},"references":[{"type":"WEB","url":"http://packetstormsecurity.com/files/169430/Zimbra-Privilege-Escalation.html"},{"type":"WEB","url":"https://twitter.com/ldsopreload/status/1580539318879547392"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/3xxx/CVE-2022-3569.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-3569"},{"type":"FIX","url":"https://github.com/rapid7/metasploit-framework/pull/17141"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/zimbra/zm-build","events":[{"introduced":"0"},{"last_affected":"b6cd8f69d2761c014d4a3807f0bdee0011386444"}],"database_specific":{"cpe":"cpe:2.3:a:synacor:zimbra_collaboration_suite:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"last_affected":"9.0.0"}],"source":"CPE_RANGE"}}],"versions":["9.0.0","8.8.12","8.8.10","8.8.9.p3","8.8.9.p1","8.8.9","8.8.8","8.7.11","8.8.7","8.8.6","8.8.4","8.8.3","8.8.2","8.8.0.beta1","8.7.10","8.7.9","8.7.7","8.7.6"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-3569.json"}},{"ranges":[{"type":"GIT","repo":"https://github.com/zimbra/zm-mailbox","events":[{"introduced":"0"},{"last_affected":"2ec276e0cd140c34d2e8aa6e2260a10901e43a9d"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"last_affected":"9.0.0"}],"source":"CPE_RANGE","cpe":"cpe:2.3:a:synacor:zimbra_collaboration_suite:*:*:*:*:*:*:*:*"}}],"versions":["9.0.0","8.8.8","8.8.12","8.8.10","8.8.9","8.8.7","8.8.6","8.8.5","8.8.4","8.8.3","8.8.2"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-3569.json"}},{"ranges":[{"type":"GIT","repo":"https://github.com/zimbra/zm-zcs","events":[{"introduced":"0"},{"last_affected":"7cf503e14f689f39bad171475fb4e151bfcc22ee"}],"database_specific":{"cpe":"cpe:2.3:a:synacor:zimbra_collaboration_suite:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"last_affected":"9.0.0"}],"source":"CPE_RANGE"}}],"versions":["9.0.0","8.8.15","8.8.12","8.8.11","8.8.10","8.8.9","8.8.8","8.7.11","8.8.7","8.8.6","8.8.5","8.8.4","8.8.3","8.8.2","8.8.0beta2","8.8.0.beta1","8.7.10","8.7.9","8.7.7","8.7.6"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-3569.json"}},{"ranges":[{"type":"GIT","repo":"https://github.com/zimbra/zm-zcs-lib","events":[{"introduced":"0"},{"last_affected":"08274721e99c2522952c640cd42e4d0cf676d432"}],"database_specific":{"cpe":"cpe:2.3:a:synacor:zimbra_collaboration_suite:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"last_affected":"9.0.0"}],"source":"CPE_RANGE"}}],"versions":["9.0.0","8.8.12","8.8.11","8.8.10","8.8.9","8.8.8","8.7.11","8.8.7","8.8.6","8.8.5","8.8.4","8.8.3","8.8.2","8.8.0.beta1","8.7.10","8.7.9","8.7.7","8.7.6"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-3569.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}