**Zimbra** security advisory ~03 February 2025: [Zimbra Collaboration Daffodil 10.0.12 Patch Release](https://wiki.zimbra.com/wiki/Zimbra_Releases/10.0.12#Security_Fixes )
This is a reason why change logs and timelines are important for security advisories: Zimbra supposedly released this on 17 December 2024. Yet the CVEs have a publish date of 03 February 2025. Open source reporting are only coming out *today*.
Only 3 out of 5 vulnerabilities have CVEs. Since they didn't provide a CVSS score, CISA as an ADP scored [CVE-2025-25064](https://cve.org/CVERecord?id=CVE-2025-25064 ) SQL injection vulnerability as **9.8 critical**.
Why you should care about patching: Zimbra Collaboration Suite has **nine** CVEs on the KEV Catalog, with four of them allowing for unauthenticated code execution. CVE-2025-25064 is more likely to get exploited than other vulnerabilities.
#zimbra #zcs #cve_2025_25064 #vulnerability #cve #infosec #cybersecurity
Not Simon 🐐
npub14g…xznd6
2025-02-10 15:04:30 UTC
Author Public Key
npub14g0mj0fmn0sepfuhp2wupyk7d8xyz7rezpmrx2gfsav9vxlwxypq4xznd6Seen on
wss://relay.momostr.pinkPublished at
2025-02-10 15:04:30 UTCEvent JSON
{
"id": "3c779f7032015513a373099fa020300773bb7ac410e60be591f27a89e928e891",
"pubkey": "aa1fb93d3b9be190a7970a9dc092de69cc41787910763329098758561bee3102",
"created_at": 1739199870,
"kind": 1,
"tags": [
[
"t",
"cve"
],
[
"t",
"cve_2025_25064"
],
[
"t",
"vulnerability"
],
[
"t",
"infosec"
],
[
"t",
"cybersecurity"
],
[
"t",
"zcs"
],
[
"proxy",
"https://infosec.exchange/@screaminggoat/113980202700650905",
"web"
],
[
"t",
"zimbra"
],
[
"proxy",
"https://infosec.exchange/users/screaminggoat/statuses/113980202700650905",
"activitypub"
],
[
"L",
"pink.momostr"
],
[
"l",
"pink.momostr.activitypub:https://infosec.exchange/users/screaminggoat/statuses/113980202700650905",
"pink.momostr"
],
[
"-"
]
],
"content": "**Zimbra** security advisory ~03 February 2025: [Zimbra Collaboration Daffodil 10.0.12 Patch Release](https://wiki.zimbra.com/wiki/Zimbra_Releases/10.0.12#Security_Fixes )\nThis is a reason why change logs and timelines are important for security advisories: Zimbra supposedly released this on 17 December 2024. Yet the CVEs have a publish date of 03 February 2025. Open source reporting are only coming out *today*.\n\nOnly 3 out of 5 vulnerabilities have CVEs. Since they didn't provide a CVSS score, CISA as an ADP scored [CVE-2025-25064](https://cve.org/CVERecord?id=CVE-2025-25064 ) SQL injection vulnerability as **9.8 critical**.\n\nWhy you should care about patching: Zimbra Collaboration Suite has **nine** CVEs on the KEV Catalog, with four of them allowing for unauthenticated code execution. CVE-2025-25064 is more likely to get exploited than other vulnerabilities.\n\n#zimbra #zcs #cve_2025_25064 #vulnerability #cve #infosec #cybersecurity",
"sig": "57d34da458019b06a6fdb795e5d0a11940f8f58d1ee25d00f35fd0cd86174afe5f26f256f981eb47a14e93a5a836aa56ea332681c1d379a890096325e8668ebd"
}