CVE-2019-9670: Zimbra Collaboration XXE

Description

PoC

None yet. Search at https://trap.biu.life/?ref=rss

References

• https://nvd.nist.gov/vuln/detail/CVE-2019-9670
• https://www.cve.org/CVERecord?id=CVE-2019-9670
• https://bugzilla.zimbra.com/show_bug.cgi?id=109129
• https://www.exploit-db.com/exploits/46693
• https://www.rapid7.com/db/vulnerabilities/synacor-zimbra-collaboration-suite-cve-2019-9670/
• https://isc.sans.edu/diary/CVE-2019-9670+Zimbra+Collaboration+Suite+XXE+vulnerability/27570/
• https://attackerkb.com/topics/CVE-2019-9670
• https://github.com/emadshanab/goby-poc/blob/main/Zimbra-XXE-(CVE-2019-9670).json
• https://github.com/runZeroInc/nuclei-templates/blob/main/http/cves/2019/CVE-2019-9670.yaml
• https://infosecwriteups.com/the-hunt-for-xxe-to-lfi-how-i-uncovered-cve-2019-9670-in-a-bug-bounty-program-5668e4afa806
• https://blog.zimbra.com/2019/03/new-zimbra-8-7-11-patch-10/
• https://www.tenable.com/cve/CVE-2019-9670
• https://github.com/rek7/Zimbra-RCE

Related Vulnerabilities

• PoCCVE-2022-27924: Zimbra Collaboration Suite - Memcached Command Injection
• PoCCVE-2025-68645: Zimbra Collaboration - Local File Inclusion
• Zimbra Collaboration 存在本地文件包含漏洞（CVE-2025-68645）
• PoCZimbra Collaboration Suite /h javax.servlet.include.path_info 文件包含漏洞（CVE-2025-68645）
• PoCCVE-2025-27915: Zimbra - Cross-Site Scripting via ICS Files
• PoCCVE-2013-7091: Zimbra Collaboration Server 7.2.2/8.0.2 Local File Inclusion
• PoCCVE-2018-14013: Synacor Zimbra Collaboration Suite Collaboration <8.8.11 - Cross-Site Scripting
• PoCCVE-2019-9670: Synacor Zimbra Collaboration <8.7.11p10 - XML External Entity Injection
• PoCCVE-2020-7796: Zimbra Collaboration Suite < 8.8.15 Patch 7 - Server-Side Request Forgery
• PoCCVE-2022-27926: Zimbra Collaboration (ZCS) - Cross Site Scripting
• PoCCVE-2022-37042: Zimbra Collaboration Suite 8.8.15/9.0 - Remote Code Execution
• PoCCVE-2023-34192: Zimbra Collaboration Suite (ZCS) v.8.8.15 - Cross-Site Scripting