Lucene search

[email protected]CVE-2018-15131

HistoryMay 30, 2019 - 4:29 p.m.

CVE-2018-15131

2019-05-3016:29:00

CWE-200

[email protected]

web.nvd.nist.gov

cve-2018-15131

synacor

zimbra

collaboration suite

patch

account enumeration

authentication

security issue

vulnerability

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

5.4 Medium

AI Score

Confidence

High

5 Medium

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

0.001 Low

EPSS

Percentile

48.1%

JSON

An issue was discovered in Synacor Zimbra Collaboration Suite 8.6.x before 8.6.0 Patch 11, 8.7.x before 8.7.11 Patch 6, 8.8.x before 8.8.8 Patch 9, and 8.8.9 before 8.8.9 Patch 3. Account number enumeration is possible via inconsistent responses for specific types of authentication requests.

Affected configurations

NVD

Node

synacorzimbra_collaboration_suiteRange8.7.0–8.7.11

synacorzimbra_collaboration_suiteRange8.8.0–8.8.8

synacorzimbra_collaboration_suiteMatch8.6.0-

synacorzimbra_collaboration_suiteMatch8.6.0p1

synacorzimbra_collaboration_suiteMatch8.6.0p10

synacorzimbra_collaboration_suiteMatch8.6.0p2

synacorzimbra_collaboration_suiteMatch8.6.0p3

synacorzimbra_collaboration_suiteMatch8.6.0p4

synacorzimbra_collaboration_suiteMatch8.6.0p5

synacorzimbra_collaboration_suiteMatch8.6.0p6

synacorzimbra_collaboration_suiteMatch8.6.0p8

synacorzimbra_collaboration_suiteMatch8.6.0p9

synacorzimbra_collaboration_suiteMatch8.7.11-

synacorzimbra_collaboration_suiteMatch8.7.11p1

synacorzimbra_collaboration_suiteMatch8.7.11p2

synacorzimbra_collaboration_suiteMatch8.7.11p3

synacorzimbra_collaboration_suiteMatch8.7.11p4

synacorzimbra_collaboration_suiteMatch8.7.11p5

synacorzimbra_collaboration_suiteMatch8.8.8-

synacorzimbra_collaboration_suiteMatch8.8.8p1

synacorzimbra_collaboration_suiteMatch8.8.8p2

synacorzimbra_collaboration_suiteMatch8.8.8p3

synacorzimbra_collaboration_suiteMatch8.8.8p4

synacorzimbra_collaboration_suiteMatch8.8.8p5

synacorzimbra_collaboration_suiteMatch8.8.8p6

synacorzimbra_collaboration_suiteMatch8.8.8p7

synacorzimbra_collaboration_suiteMatch8.8.9-

synacorzimbra_collaboration_suiteMatch8.8.9p1

synacorzimbra_collaboration_suiteMatch8.8.9p2

CPENameOperatorVersion
synacor:zimbra_collaboration_suitesynacor zimbra collaboration suitelt8.7.11
synacor:zimbra_collaboration_suitesynacor zimbra collaboration suitelt8.8.8
synacor:zimbra_collaboration_suitesynacor zimbra collaboration suiteeq8.6.0
synacor:zimbra_collaboration_suitesynacor zimbra collaboration suiteeq8.8.9

CPE	Name	Operator	Version
synacor:zimbra_collaboration_suite	synacor zimbra collaboration suite	lt	8.7.11
synacor:zimbra_collaboration_suite	synacor zimbra collaboration suite	lt	8.8.8
synacor:zimbra_collaboration_suite	synacor zimbra collaboration suite	eq	8.6.0
synacor:zimbra_collaboration_suite	synacor zimbra collaboration suite	eq	8.8.9

References

bugzilla.zimbra.com/show_bug.cgi?id=109012

wiki.zimbra.com/wiki/Zimbra_Security_Advisories

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

5.4 Medium

AI Score

Confidence

High

5 Medium

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

0.001 Low

EPSS

Percentile

48.1%

JSON

Related for CVE-2018-15131

cvelist1 nvd1 osv1 prion1