CVE-2020-10194

cs/service/account/AutoCompleteGal.java in Zimbra zm-mailbox before 8.8.15.p8 allows authenticated users to request any GAL account. This differs from the intended behavior in which the domain of the authenticated user must match the domain of the galsync account in the request...

CVE-2020-10194

CVE-2020-10194 affects Zimbra zm-mailbox prior to 8.8.15.p8. The flaw is in cs/service/account/AutoCompleteGal.java, where authenticated users can request any GAL account due to domain-matching checks not behaving as intended. Connected sources (including Red Hat and CNVD variants) corroborate th...