{"id":1532356,"date":"2025-02-10T08:53:13","date_gmt":"2025-02-10T10:53:13","guid":{"rendered":"https:\/\/teknomers.com\/fr\/zimbra-publie-des-mises-a-jour-de-securite-pour-linjection-sql-les-xss-stockes-et-les-vulnerabilites-ssrf\/"},"modified":"2025-02-10T08:53:18","modified_gmt":"2025-02-10T10:53:18","slug":"zimbra-publie-des-mises-a-jour-de-securite-pour-linjection-sql-les-xss-stockes-et-les-vulnerabilites-ssrf","status":"publish","type":"post","link":"https:\/\/teknomers.com\/fr\/zimbra-publie-des-mises-a-jour-de-securite-pour-linjection-sql-les-xss-stockes-et-les-vulnerabilites-ssrf\/","title":{"rendered":"Zimbra publie des mises \u00e0 jour de s\u00e9curit\u00e9 pour l&#8217;injection SQL, les XSS stock\u00e9s et les vuln\u00e9rabilit\u00e9s SSRF"},"content":{"rendered":"<p> <br \/>\n<\/p>\n<div>\n<p><span class=\"p-author\"><i class=\"icon-font icon-calendar\">\ue802<\/i><span class=\"author\">10 f\u00e9vrier 2025<\/span><i class=\"icon-font icon-user\">\ue804<\/i><span class=\"author\">Ravie Lakshmanan<\/span><\/span><span class=\"p-tags\">Vuln\u00e9rabilit\u00e9 \/ protection des donn\u00e9es<\/span><\/p>\n<\/div>\n<div id=\"articlebody\">\n<div class=\"separator\" style=\"clear: both;\"><a rel=\"nofollow\" href=\"https:\/\/teknomers.com\/fr\/wp-content\/uploads\/2025\/02\/Zimbra-publie-des-mises-a-jour-de-securite-pour-linjection.png\" style=\"clear: left; display: block; float: left;  text-align: center;\"><\/a><\/div>\n<p>Zimbra a publi\u00e9 des mises \u00e0 jour logicielles pour aborder des d\u00e9fauts de s\u00e9curit\u00e9 critiques dans son logiciel de collaboration qui, s&#8217;il est exploit\u00e9 avec succ\u00e8s, pourrait entra\u00eener une divulgation d&#8217;informations dans certaines conditions.<\/p>\n<p>La vuln\u00e9rabilit\u00e9, suivie comme <a rel=\"noopener nofollow\" href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2025-25064\" target=\"_blank\">CVE-2025-25064<\/a>porte un score CVSS de 9,8 sur un maximum de 10,0. Il a \u00e9t\u00e9 d\u00e9crit comme un bogue d&#8217;injection SQL dans le point de terminaison de savon de service Zimbrasync affectant les versions avant 10.0.12 et 10.1.4.<\/p>\n<p>R\u00e9sultant d&#8217;un manque de d\u00e9sinfection ad\u00e9quate d&#8217;un param\u00e8tre fourni par l&#8217;utilisateur, la lacune pourrait \u00eatre arm\u00e9e par des attaquants authentifi\u00e9s pour injecter des requ\u00eates SQL arbitraires qui pourraient r\u00e9cup\u00e9rer les m\u00e9tadonn\u00e9es par e-mail en &#8220;manipulant un param\u00e8tre sp\u00e9cifique dans la demande&#8221;.<\/p>\n<div class=\"dog_two clear\"><center class=\"cf\"><a rel=\"nofollow noopener sponsored\" href=\"https:\/\/thehackernews.uk\/encrypted-attacks-report-d\" target=\"_blank\" title=\"Cybersecurity\"><img loading=\"lazy\" decoding=\"async\" class=\"lazyload\" alt=\"Cybers\u00e9curit\u00e9\" src=\"https:\/\/teknomers.com\/fr\/wp-content\/uploads\/2025\/02\/Meta-confirme-lattaque-de-logiciels-spyware-zero-clique.jpg\" width=\"727\" height=\"90\"\/><\/a><\/center><\/div>\n<p>Zimbra a \u00e9galement d\u00e9clar\u00e9 avoir abord\u00e9 une autre vuln\u00e9rabilit\u00e9 critique li\u00e9e aux scripts inter-sites stock\u00e9s (XSS) dans le client Web Zimbra Classic. La faille n&#8217;a pas encore \u00e9t\u00e9 attribu\u00e9e \u00e0 un identifiant CVE.<\/p>\n<p>&#8220;Le correctif renforce la d\u00e9sinfection des entr\u00e9es et am\u00e9liore la s\u00e9curit\u00e9&#8221;, la soci\u00e9t\u00e9 <a rel=\"noopener nofollow\" href=\"https:\/\/wiki.zimbra.com\/wiki\/Zimbra_Security_Advisories\" target=\"_blank\">dit<\/a> Dans un avis, l&#8217;ajout du probl\u00e8me a \u00e9t\u00e9 r\u00e9solu dans les versions 9.0.0 Patch 44, 10.0.13 et 10.1.5.<\/p>\n<p>Une autre vuln\u00e9rabilit\u00e9 abord\u00e9e par Zimbra est <a rel=\"noopener nofollow\" href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2025-25065\" target=\"_blank\">CVE-2025-25065<\/a> (Score CVSS: 5.3), une d\u00e9faut de contrefa\u00e7on de demande c\u00f4t\u00e9 serveur (SSRF) de la s\u00e9v\u00e9rit\u00e9 moyenne dans le composant RSS Feed Parser qui permet une redirection non autoris\u00e9e vers des points d&#8217;extr\u00e9mit\u00e9 du r\u00e9seau interne.<\/p>\n<p>Le d\u00e9faut de s\u00e9curit\u00e9 a \u00e9t\u00e9 corrig\u00e9 dans les versions 9.0.0 Patch 43, 10.0.12 et 10.1.4. Il est conseill\u00e9 aux clients de mettre \u00e0 jour les derni\u00e8res versions de la collaboration Zimbra pour une protection optimale.<\/p>\n<p><\/p>\n<div class=\"cf note-b\">Vous avez trouv\u00e9 cet article int\u00e9ressant? Suivez-nous <a rel=\"noopener nofollow\" href=\"https:\/\/twitter.com\/thehackersnews\" target=\"_blank\">Gazouillement <i class=\"icon-font icon-twitter\">\uf099<\/i><\/a>  et <a rel=\"noopener nofollow\" href=\"https:\/\/www.linkedin.com\/company\/thehackernews\/\" target=\"_blank\">Liendin<\/a> Pour lire plus de contenu exclusif que nous publions.<\/div>\n<\/div>\n<p><script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><br \/>\n<br \/><br \/>\n<br \/><a href=\"https:\/\/thehackernews.com\/2025\/02\/zimbra-releases-security-updates-for.html\" rel=\"nofollow noopener\" target=\"_blank\">ttn-fr-57<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>\ue80210 f\u00e9vrier 2025\ue804Ravie LakshmananVuln\u00e9rabilit\u00e9 \/ protection des donn\u00e9es Zimbra a publi\u00e9 des mises \u00e0 jour logicielles pour aborder des d\u00e9fauts de s\u00e9curit\u00e9 critiques dans son logiciel de collaboration qui, s&#8217;il est exploit\u00e9 avec succ\u00e8s, pourrait entra\u00eener une divulgation d&#8217;informations dans certaines conditions. La vuln\u00e9rabilit\u00e9, suivie comme CVE-2025-25064porte un score CVSS de 9,8 sur un maximum [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":1532357,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6],"tags":[274266,274265,4168,79002,274264,4161,274263,6124,133,3995,65,11965,274267,5115,4160,185,2212,1835,238617,246491,4172,8542,228416,144514,79016,4166,4164,12365,256572,12362],"class_list":["post-1532356","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-technologie","tag-actualites-de-piratage","tag-actualites-des-pirates","tag-comment-pirater","tag-cyber-security-news","tag-cyber-security-news-aujourdhui","tag-cyber-mises-a-jour","tag-cyber-nouvelles","tag-cyberattaques","tag-des","tag-jour","tag-les","tag-linjection","tag-malware-ransomware","tag-mises","tag-mises-a-jour-de-la-cybersecurite","tag-pour","tag-publie","tag-securite","tag-securite-de-linformation","tag-securite-du-reseau","tag-securite-informatique","tag-sql","tag-ssrf","tag-stockes","tag-the-hacker-news","tag-violation-de-donnees","tag-vulnerabilite-logicielle","tag-vulnerabilites","tag-xss","tag-zimbra"],"_links":{"self":[{"href":"https:\/\/teknomers.com\/fr\/wp-json\/wp\/v2\/posts\/1532356","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/teknomers.com\/fr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/teknomers.com\/fr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/teknomers.com\/fr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/teknomers.com\/fr\/wp-json\/wp\/v2\/comments?post=1532356"}],"version-history":[{"count":0,"href":"https:\/\/teknomers.com\/fr\/wp-json\/wp\/v2\/posts\/1532356\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/teknomers.com\/fr\/wp-json\/wp\/v2\/media\/1532357"}],"wp:attachment":[{"href":"https:\/\/teknomers.com\/fr\/wp-json\/wp\/v2\/media?parent=1532356"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/teknomers.com\/fr\/wp-json\/wp\/v2\/categories?post=1532356"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/teknomers.com\/fr\/wp-json\/wp\/v2\/tags?post=1532356"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}