CVE-2020-7796

What is Zimbra Collaboration Suite?

Zimbra is a self-hosted email and collaboration platform used as an alternative to Microsoft Exchange or Google Workspace, popular with government agencies, universities, and organizations that prefer to keep their email infrastructure on-premises. Zimbra supports "zimlets" — plugin modules that extend the webmail client with additional integrations, one of which bundles a WebEx conferencing integration into the mailbox interface.

Overview

CVE-2020-7796 is a server-side request forgery vulnerability (CWE-918) present when a Zimbra deployment has the WebEx zimlet installed and its JSP proxy component enabled. The zimlet's JSP page is designed to proxy certain requests on behalf of the client, but does not adequately restrict which destination URLs it will fetch — allowing an attacker to direct the Zimbra server itself to make requests to arbitrary internal or external destinations, potentially reaching internal-only services, cloud metadata endpoints, or other resources the Zimbra server can reach but an external attacker normally couldn't (CVSS 3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8 Critical).

Affected Versions

Technical Details

Because the vulnerable code path only triggers when the optional WebEx zimlet is installed and its JSP proxy feature is active, exposure depends on deployment configuration rather than affecting every Zimbra install by default. Where it is enabled, the proxy's failure to validate or restrict target URLs turns it into a general-purpose SSRF primitive — letting a remote, unauthenticated attacker use the Zimbra server as a relay to probe or interact with internal network resources.

Discovery

Fixed by Synacor (Zimbra's maintainer at the time) in Collaboration Suite 8.8.15 Patch 7; public vulnerability tracking attributes the fix to routine security hardening of zimlet proxy handling.

Exploitation Context

Zimbra has been a recurring target for both opportunistic and targeted attackers throughout the early 2020s given its footprint in government and higher-education email deployments — see our Zimbra XSS threat cluster coverage for related campaigns against the platform. CISA's KEV addition in early 2026, years after the original 2020 patch, indicates renewed confirmed exploitation activity against Zimbra deployments that never applied the WebEx zimlet fix.

Remediation

1. Apply Zimbra Collaboration Suite 8.8.15 Patch 7 or later immediately.
2. If the WebEx zimlet isn't actively used, disable or remove it entirely rather than leaving an unused integration's proxy feature enabled.
3. Restrict outbound network access from the Zimbra server at the firewall level, limiting what internal or cloud resources it can reach even if an SSRF primitive exists elsewhere in the stack.
4. Review Zimbra server logs for anomalous outbound requests originating from the zimlet proxy path, particularly requests to internal IP ranges or cloud metadata endpoints (e.g., 169.254.169.254).