Read the docs
TI-2021-14103 Aliases CVE-2021-35209GHSA-wv5j-j74p-fv28

An issue was discovered in ProxyServlet.java in the /proxy servlet in Zimbra…

Priority MEDIUM 48CWE-918Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

An issue was discovered in ProxyServlet.java in the /proxy servlet in Zimbra Collaboration Suite 8.8 before 8.8.15 Patch 23 and 9.x before 9.0.0 Patch 16. The value of the X-Host header overwrites the value of the Host header in proxied requests. The value of X-Host header is not checked against the whitelist of hosts Zimbra is allowed to proxy to (the zimbraProxyAllowedDomains setting).

Why it matters now

EPSS 0.02995 87th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 34

CPEVersionsRoleVendor
cpe:2.3:a:zimbra:collaboration:*:*:*:*:*:*:*:*8.8 to before 8.8.15VulnerableZimbra
cpe:2.3:a:zimbra:collaboration:8.8.15:-:*:*:*:*:*:*8.8.15VulnerableZimbra
cpe:2.3:a:zimbra:collaboration:8.8.15:p1:*:*:*:*:*:*8.8.15 p1VulnerableZimbra
cpe:2.3:a:zimbra:collaboration:8.8.15:p10:*:*:*:*:*:*8.8.15 p10VulnerableZimbra
cpe:2.3:a:zimbra:collaboration:8.8.15:p11:*:*:*:*:*:*8.8.15 p11VulnerableZimbra
cpe:2.3:a:zimbra:collaboration:8.8.15:p12:*:*:*:*:*:*8.8.15 p12VulnerableZimbra
cpe:2.3:a:zimbra:collaboration:8.8.15:p13:*:*:*:*:*:*8.8.15 p13VulnerableZimbra
cpe:2.3:a:zimbra:collaboration:8.8.15:p14:*:*:*:*:*:*8.8.15 p14VulnerableZimbra
cpe:2.3:a:zimbra:collaboration:8.8.15:p15:*:*:*:*:*:*8.8.15 p15VulnerableZimbra
cpe:2.3:a:zimbra:collaboration:8.8.15:p16:*:*:*:*:*:*8.8.15 p16VulnerableZimbra
  • cpe:2.3:a:zimbra:collaboration:*:*:*:*:*:*:*:* Versions 8.8 to before 8.8.15 Vulnerable ·Zimbra
  • cpe:2.3:a:zimbra:collaboration:8.8.15:-:*:*:*:*:*:* Versions 8.8.15 Vulnerable ·Zimbra
  • cpe:2.3:a:zimbra:collaboration:8.8.15:p1:*:*:*:*:*:* Versions 8.8.15 p1 Vulnerable ·Zimbra
  • cpe:2.3:a:zimbra:collaboration:8.8.15:p10:*:*:*:*:*:* Versions 8.8.15 p10 Vulnerable ·Zimbra
  • cpe:2.3:a:zimbra:collaboration:8.8.15:p11:*:*:*:*:*:* Versions 8.8.15 p11 Vulnerable ·Zimbra
  • cpe:2.3:a:zimbra:collaboration:8.8.15:p12:*:*:*:*:*:* Versions 8.8.15 p12 Vulnerable ·Zimbra
  • cpe:2.3:a:zimbra:collaboration:8.8.15:p13:*:*:*:*:*:* Versions 8.8.15 p13 Vulnerable ·Zimbra
  • cpe:2.3:a:zimbra:collaboration:8.8.15:p14:*:*:*:*:*:* Versions 8.8.15 p14 Vulnerable ·Zimbra
  • cpe:2.3:a:zimbra:collaboration:8.8.15:p15:*:*:*:*:*:* Versions 8.8.15 p15 Vulnerable ·Zimbra
  • cpe:2.3:a:zimbra:collaboration:8.8.15:p16:*:*:*:*:*:* Versions 8.8.15 p16 Vulnerable ·Zimbra
Show 24 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:zimbra:collaboration:8.8.15:p17:*:*:*:*:*:*8.8.15 p17VulnerableZimbra
cpe:2.3:a:zimbra:collaboration:8.8.15:p18:*:*:*:*:*:*8.8.15 p18VulnerableZimbra
cpe:2.3:a:zimbra:collaboration:8.8.15:p19:*:*:*:*:*:*8.8.15 p19VulnerableZimbra
cpe:2.3:a:zimbra:collaboration:8.8.15:p2:*:*:*:*:*:*8.8.15 p2VulnerableZimbra
cpe:2.3:a:zimbra:collaboration:8.8.15:p3:*:*:*:*:*:*8.8.15 p3VulnerableZimbra
cpe:2.3:a:zimbra:collaboration:8.8.15:p4:*:*:*:*:*:*8.8.15 p4VulnerableZimbra
cpe:2.3:a:zimbra:collaboration:8.8.15:p5:*:*:*:*:*:*8.8.15 p5VulnerableZimbra
cpe:2.3:a:zimbra:collaboration:8.8.15:p6:*:*:*:*:*:*8.8.15 p6VulnerableZimbra
cpe:2.3:a:zimbra:collaboration:8.8.15:p7:*:*:*:*:*:*8.8.15 p7VulnerableZimbra
cpe:2.3:a:zimbra:collaboration:8.8.15:p8:*:*:*:*:*:*8.8.15 p8VulnerableZimbra
cpe:2.3:a:zimbra:collaboration:8.8.15:p9:*:*:*:*:*:*8.8.15 p9VulnerableZimbra
cpe:2.3:a:zimbra:collaboration:9.0.0:-:*:*:*:*:*:*9.0.0VulnerableZimbra
cpe:2.3:a:zimbra:collaboration:9.0.0:p1:*:*:*:*:*:*9.0.0 p1VulnerableZimbra
cpe:2.3:a:zimbra:collaboration:9.0.0:p10:*:*:*:*:*:*9.0.0 p10VulnerableZimbra
cpe:2.3:a:zimbra:collaboration:9.0.0:p11:*:*:*:*:*:*9.0.0 p11VulnerableZimbra
cpe:2.3:a:zimbra:collaboration:9.0.0:p12:*:*:*:*:*:*9.0.0 p12VulnerableZimbra
cpe:2.3:a:zimbra:collaboration:9.0.0:p2:*:*:*:*:*:*9.0.0 p2VulnerableZimbra
cpe:2.3:a:zimbra:collaboration:9.0.0:p3:*:*:*:*:*:*9.0.0 p3VulnerableZimbra
cpe:2.3:a:zimbra:collaboration:9.0.0:p4:*:*:*:*:*:*9.0.0 p4VulnerableZimbra
cpe:2.3:a:zimbra:collaboration:9.0.0:p5:*:*:*:*:*:*9.0.0 p5VulnerableZimbra
cpe:2.3:a:zimbra:collaboration:9.0.0:p6:*:*:*:*:*:*9.0.0 p6VulnerableZimbra
cpe:2.3:a:zimbra:collaboration:9.0.0:p7:*:*:*:*:*:*9.0.0 p7VulnerableZimbra
cpe:2.3:a:zimbra:collaboration:9.0.0:p8:*:*:*:*:*:*9.0.0 p8VulnerableZimbra
cpe:2.3:a:zimbra:collaboration:9.0.0:p9:*:*:*:*:*:*9.0.0 p9VulnerableZimbra
  • cpe:2.3:a:zimbra:collaboration:8.8.15:p17:*:*:*:*:*:* Versions 8.8.15 p17 Vulnerable ·Zimbra
  • cpe:2.3:a:zimbra:collaboration:8.8.15:p18:*:*:*:*:*:* Versions 8.8.15 p18 Vulnerable ·Zimbra
  • cpe:2.3:a:zimbra:collaboration:8.8.15:p19:*:*:*:*:*:* Versions 8.8.15 p19 Vulnerable ·Zimbra
  • cpe:2.3:a:zimbra:collaboration:8.8.15:p2:*:*:*:*:*:* Versions 8.8.15 p2 Vulnerable ·Zimbra
  • cpe:2.3:a:zimbra:collaboration:8.8.15:p3:*:*:*:*:*:* Versions 8.8.15 p3 Vulnerable ·Zimbra
  • cpe:2.3:a:zimbra:collaboration:8.8.15:p4:*:*:*:*:*:* Versions 8.8.15 p4 Vulnerable ·Zimbra
  • cpe:2.3:a:zimbra:collaboration:8.8.15:p5:*:*:*:*:*:* Versions 8.8.15 p5 Vulnerable ·Zimbra
  • cpe:2.3:a:zimbra:collaboration:8.8.15:p6:*:*:*:*:*:* Versions 8.8.15 p6 Vulnerable ·Zimbra
  • cpe:2.3:a:zimbra:collaboration:8.8.15:p7:*:*:*:*:*:* Versions 8.8.15 p7 Vulnerable ·Zimbra
  • cpe:2.3:a:zimbra:collaboration:8.8.15:p8:*:*:*:*:*:* Versions 8.8.15 p8 Vulnerable ·Zimbra
  • cpe:2.3:a:zimbra:collaboration:8.8.15:p9:*:*:*:*:*:* Versions 8.8.15 p9 Vulnerable ·Zimbra
  • cpe:2.3:a:zimbra:collaboration:9.0.0:-:*:*:*:*:*:* Versions 9.0.0 Vulnerable ·Zimbra
  • cpe:2.3:a:zimbra:collaboration:9.0.0:p1:*:*:*:*:*:* Versions 9.0.0 p1 Vulnerable ·Zimbra
  • cpe:2.3:a:zimbra:collaboration:9.0.0:p10:*:*:*:*:*:* Versions 9.0.0 p10 Vulnerable ·Zimbra
  • cpe:2.3:a:zimbra:collaboration:9.0.0:p11:*:*:*:*:*:* Versions 9.0.0 p11 Vulnerable ·Zimbra
  • cpe:2.3:a:zimbra:collaboration:9.0.0:p12:*:*:*:*:*:* Versions 9.0.0 p12 Vulnerable ·Zimbra
  • cpe:2.3:a:zimbra:collaboration:9.0.0:p2:*:*:*:*:*:* Versions 9.0.0 p2 Vulnerable ·Zimbra
  • cpe:2.3:a:zimbra:collaboration:9.0.0:p3:*:*:*:*:*:* Versions 9.0.0 p3 Vulnerable ·Zimbra
  • cpe:2.3:a:zimbra:collaboration:9.0.0:p4:*:*:*:*:*:* Versions 9.0.0 p4 Vulnerable ·Zimbra
  • cpe:2.3:a:zimbra:collaboration:9.0.0:p5:*:*:*:*:*:* Versions 9.0.0 p5 Vulnerable ·Zimbra
  • cpe:2.3:a:zimbra:collaboration:9.0.0:p6:*:*:*:*:*:* Versions 9.0.0 p6 Vulnerable ·Zimbra
  • cpe:2.3:a:zimbra:collaboration:9.0.0:p7:*:*:*:*:*:* Versions 9.0.0 p7 Vulnerable ·Zimbra
  • cpe:2.3:a:zimbra:collaboration:9.0.0:p8:*:*:*:*:*:* Versions 9.0.0 p8 Vulnerable ·Zimbra
  • cpe:2.3:a:zimbra:collaboration:9.0.0:p9:*:*:*:*:*:* Versions 9.0.0 p9 Vulnerable ·Zimbra

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-35209
  2. 2026-10-03 Alias added: GHSA-wv5j-j74p-fv28

References

Exploit 1

Advisory 4

  • TI-2024-18266 An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0. KEVCVSS 3.1MEDIUM 6.1
  • TI-2024-30553 An issue was discovered in Zimbra Collaboration (ZCS) 10.1.x before 10.1.1, 10.0.x before… CVSS 3.1HIGH 8.8
  • TI-2022-13998 Zimbra Collaboration Open Source 8.8.15 does not encrypt the initial-login randomly… CVSS 3.1CRITICAL 9.8
  • TI-2023-13772 An issue in Zimbra Collaboration ZCS v.8.8.15 and v.9.0 allows an attacker to execute… CVSS 3.1CRITICAL 9.8
  • TI-2023-13771 An issue in Zimbra Collaboration (ZCS) v.8.8.15 and v.9.0 allows a remote attacker to… CVSS 3.1CRITICAL 9.8
  • TI-2023-27722 Zimbra Collaboration before Kepler 9.0.0 Patch 38 GA allows DOM-based JavaScript injection in the Modern UI. CVSS 3.1CRITICAL 9.1
See all 40 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences