Home

Description

SQL injection vulnerability in the ZimbraSync Service SOAP endpoint in Zimbra Collaboration 10.0.x before 10.0.12 and 10.1.x before 10.1.4 due to insufficient sanitization of a user-supplied parameter. Authenticated attackers can exploit this vulnerability by manipulating a specific parameter in the request, allowing them to inject arbitrary SQL queries that could retrieve email metadata.

PUBLISHED Reserved 2025-02-03 | Published 2025-02-03 | Updated 2025-03-14 | Assigner mitre

References

wiki.zimbra.com/wiki/Zimbra_Security_Advisories

wiki.zimbra.com/wiki/Zimbra_Releases/10.1.4

wiki.zimbra.com/wiki/Zimbra_Releases/10.0.12

cve.org (CVE-2025-25064)

nvd.nist.gov (CVE-2025-25064)

Download JSON

Data based on CVE®. Copyright © 1999-2025, The MITRE Corporation. All rights reserved.