{"id":"CVE-2024-54663","details":"An issue was discovered in the Webmail Classic UI in Zimbra Collaboration (ZCS) 9.0 and 10.0 and 10.1. A Local File Inclusion (LFI) vulnerability exists in the /h/rest endpoint, allowing authenticated remote attackers to include and access sensitive files in the WebRoot directory. Exploitation requires a valid auth token and involves crafting a malicious request targeting specific file paths.","modified":"2026-08-12T14:52:20.012447Z","published":"2024-12-19T00:00:00Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/54xxx/CVE-2024-54663.json","cna_assigner":"mitre"},"references":[{"type":"WEB","url":"https://wiki.zimbra.com/wiki/Zimbra_Releases/10.0.11#Security_Fixes"},{"type":"WEB","url":"https://wiki.zimbra.com/wiki/Zimbra_Releases/10.1.3#Security_Fixes"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/54xxx/CVE-2024-54663.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-54663"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/zimbra/zm-mailbox","events":[{"introduced":"2ec276e0cd140c34d2e8aa6e2260a10901e43a9d"},{"fixed":"0068692c007c4396024893cf961cfe633667f9ee"},{"introduced":"de2f187263204c5edbcd64ab4aad155367f27eef"},{"fixed":"d3367a24f789e991caa7690299d8e0fff15664d2"}],"database_specific":{"cpe":"cpe:2.3:a:synacor:zimbra_collaboration_suite:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"9.0.0"},{"fixed":"10.0.11"},{"introduced":"10.1.0"},{"fixed":"10.1.3"}],"source":"CPE_RANGE"}}],"versions":["10.0.9","10.1.2","10.1.1","10.1.0","10.0.8","10.0.0","10.0.7","10.0.6","10.0.5","10.0.2","10.0.1","10.0.0-GA","9.0.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-54663.json","vanir_signatures_modified":"2026-08-12T14:52:20Z","vanir_signatures":[{"deprecated":false,"digest":{"line_hashes":["293476507431958131404167032974032467993","110084317960895620792832720618015736896","340213455265195935999810063892549280386","84422352583974192002360095392860473907","101925642364125023685609308323644423619","31561228545396266183464262746029819015","64611849619378506423783006189280918231","333113243727841782649177014744596852525","336439996810183764694236009078007948649","63871200752977416365213023436439422401","8402874607266349149096628273512944818","28066954028696881101906947503684848034","265514127333621232979464759051295567772"],"threshold":0.9},"id":"CVE-2024-54663-219fd941","signature_type":"Line","signature_version":"v1","source":"https://github.com/zimbra/zm-mailbox/commit/0068692c007c4396024893cf961cfe633667f9ee","target":{"file":"store/src/java/com/zimbra/cs/account/ProvUtil.java"}},{"deprecated":false,"digest":{"line_hashes":["293476507431958131404167032974032467993","110084317960895620792832720618015736896","340213455265195935999810063892549280386","84422352583974192002360095392860473907","101925642364125023685609308323644423619","31561228545396266183464262746029819015","64611849619378506423783006189280918231","333113243727841782649177014744596852525","336439996810183764694236009078007948649","63871200752977416365213023436439422401","8402874607266349149096628273512944818","28066954028696881101906947503684848034","265514127333621232979464759051295567772"],"threshold":0.9},"id":"CVE-2024-54663-5b656ed5","signature_type":"Line","signature_version":"v1","source":"https://github.com/zimbra/zm-mailbox/commit/d3367a24f789e991caa7690299d8e0fff15664d2","target":{"file":"store/src/java/com/zimbra/cs/account/ProvUtil.java"}},{"source":"https://github.com/zimbra/zm-mailbox/commit/d3367a24f789e991caa7690299d8e0fff15664d2","target":{"file":"store/src/java/com/zimbra/cs/account/ProvUtil.java","function":"doCreateAccountsBulk"},"deprecated":false,"digest":{"length":595,"function_hash":"56417046871487832888266304611322150134"},"id":"CVE-2024-54663-99904d9a","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"length":595,"function_hash":"56417046871487832888266304611322150134"},"id":"CVE-2024-54663-bf9e7661","signature_type":"Function","signature_version":"v1","source":"https://github.com/zimbra/zm-mailbox/commit/0068692c007c4396024893cf961cfe633667f9ee","target":{"file":"store/src/java/com/zimbra/cs/account/ProvUtil.java","function":"doCreateAccountsBulk"}}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"}]}