CVE report
CVE-2019-9621highKEV
Zimbra Collaboration Suite - SSRF
Events 90d
191
Distinct IPs
138
Severity
high
CISA KEV
Actively exploited
Detection signature
An event counts toward CVE-2019-9621 when its URL path contains any of these (case-insensitive). This is what our matching is based on.
- · /autodiscover
Pre-disclosure activity
all early actors →Analysing probe history around the publication date…
Recent probe volume (last 7 days)
peak: 13 events/dayeventsdistinct IPs
Downloads & integrations
Top sources probing for CVE-2019-9621
- 185.93.89.4312 eventsIran· Limited Network LTD
- 100.48.18.22412 eventsUnited States
- 179.43.186.2417 eventsSwitzerland· Private Layer INC
- 74.249.104.1936 eventsUnited States· Microsoft Corporation
- 20.17.96.2444 eventsMalaysia· Microsoft Corporation
- 101.36.125.584 eventsHong Kong· UCLOUD INFORMATION TECHNOLOGY HK LIMITED
- 179.43.163.263 eventsSwitzerland· Private Layer INC
- 13.89.124.2163 eventsUnited States
- 79.124.40.1743 eventsBulgaria· Tamatiya EOOD
- 185.177.72.232 eventsFrance· Bucklog SARL
- 20.84.153.1852 eventsUnited States
- 20.163.38.1292 eventsUnited States
- 20.14.73.1982 eventsUnited States
- 20.65.192.672 eventsUnited States
- 31.59.160.32 eventsUnited Arab Emirates· Miteflux Technologies Ltd
- 128.203.200.2162 eventsUnited Kingdom
- 20.65.193.1522 eventsUnited States
- 135.237.126.1271 eventsUnited States
- 135.237.123.2541 eventsUnited States
- 20.65.192.661 eventsUnited States
- 20.64.96.2051 eventsUnited States
- 135.237.125.271 eventsUnited States
- 20.65.194.611 eventsUnited States
- 20.65.194.1621 eventsUnited States
- 20.65.194.1671 eventsUnited States
- 172.212.200.1951 eventsUnited States
- 20.169.53.81 eventsUnited States
- 20.65.193.2061 eventsUnited States
- 20.14.78.2531 eventsUnited States
- 20.65.195.461 eventsUnited States
Top networks the attempts come from
- AS8075 Microsoft Corporation129 IPs · 145 ev
- AS213790 Limited Network LTD1 IPs · 12 ev
- AS14618 Amazon.com, Inc.1 IPs · 12 ev
- AS51852 Private Layer INC2 IPs · 10 ev
- AS135377 UCLOUD INFORMATION TECHNOLOGY HK LIMITED1 IPs · 4 ev
- AS50360 Tamatiya EOOD1 IPs · 3 ev
- AS211590 Bucklog SARL1 IPs · 2 ev
- AS203861 Miteflux Technologies Ltd1 IPs · 2 ev
- AS9009 M247 Europe SRL1 IPs · 1 ev
Fingerprints of the clients exploiting this
The HTTP (JA4H) and TLS (JA4) fingerprints seen on these attempts. Click one to see the whole population that carries it.
ja4h: ge11nn0400_88d30a62b7adja4h: ge11nn14en_068ebe3632ecja4h: ge11nn0400_91d9e55fb80aja4h: ge11nn06en_35b65d0b464fja4h: ge11nn0400_9c3956fad5daja4h: ge11nn05en_813e32c09d15ja4: t12i130500_2d7513195f68_e51b7354d87fja4: t13i4311h1_c7886603b240_b26ce05bbdd6ja4: t13i130900_f57a46bbacb6_e7c285222651ja4: t13i251000_b78ed14e2fd0_ab7e3b40a677ja4: t13i100800_61a7ad8aa9b6_d268365384ff
Sample request paths observed
- /autodiscover/autodiscover.json?@test.com/owa/?&Email=autodiscover/autodiscover.json%3F@test.com
- /autodiscover/
- /Autodiscover/AutodiscoverService.svc/root
- /autodiscover/autodiscover.json?@zdi/Powershell
- /autodiscover
- /autodiscover/autodiscover.json?@test.com/mapi/emsmdb?&Email=autodiscover/autodiscover.json%3F@test.com
- /autodiscover/autodiscover.json?@test.com/mapi/nspi/?&Email=autodiscover/autodiscover.json%3F@test.com
- /autodiscover/autodiscover.json
- /autodiscover/autodiscover.xml/
- /autodiscover/autodiscover.xml