CVE-2018-15131

Published: May 30, 2019Modified: Nov 21, 2024

5.3

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Exploitability: 3.9 / Impact: 1.4

Source: NVD

Description

An issue was discovered in Synacor Zimbra Collaboration Suite 8.6.x before 8.6.0 Patch 11, 8.7.x before 8.7.11 Patch 6, 8.8.x before 8.8.8 Patch 9, and 8.8.9 before 8.8.9 Patch 3. Account number enumeration is possible via inconsistent responses for specific types of authentication requests.

Affected (29)

Products: Synacor: Zimbra Collaboration Suite

Synacor

1 product

Zimbra Collaboration Suite

Configuration A

29 vulnerable

Vulnerable Software	Affected Versions
Synacor Zimbra Collaboration Suite	From 8.7.0 to 8.7.11
Synacor Zimbra Collaboration Suite	From 8.8.0 to 8.8.8
Synacor Zimbra Collaboration Suite	Version 8.6.0
Synacor Zimbra Collaboration Suite	Version 8.6.0 p10
Synacor Zimbra Collaboration Suite	Version 8.6.0 p1
Synacor Zimbra Collaboration Suite	Version 8.6.0 p2
Synacor Zimbra Collaboration Suite	Version 8.6.0 p3
Synacor Zimbra Collaboration Suite	Version 8.6.0 p4
Synacor Zimbra Collaboration Suite	Version 8.6.0 p5
Synacor Zimbra Collaboration Suite	Version 8.6.0 p6
Synacor Zimbra Collaboration Suite	Version 8.6.0 p8
Synacor Zimbra Collaboration Suite	Version 8.6.0 p9
Synacor Zimbra Collaboration Suite	Version 8.7.11
Synacor Zimbra Collaboration Suite	Version 8.7.11 p1
Synacor Zimbra Collaboration Suite	Version 8.7.11 p2
Synacor Zimbra Collaboration Suite	Version 8.7.11 p3
Synacor Zimbra Collaboration Suite	Version 8.7.11 p4
Synacor Zimbra Collaboration Suite	Version 8.7.11 p5
Synacor Zimbra Collaboration Suite	Version 8.8.8
Synacor Zimbra Collaboration Suite	Version 8.8.8 p1
Synacor Zimbra Collaboration Suite	Version 8.8.8 p2
Synacor Zimbra Collaboration Suite	Version 8.8.8 p3
Synacor Zimbra Collaboration Suite	Version 8.8.8 p4
Synacor Zimbra Collaboration Suite	Version 8.8.8 p5
Synacor Zimbra Collaboration Suite	Version 8.8.8 p6
Synacor Zimbra Collaboration Suite	Version 8.8.8 p7
Synacor Zimbra Collaboration Suite	Version 8.8.9
Synacor Zimbra Collaboration Suite	Version 8.8.9 p1
Synacor Zimbra Collaboration Suite	Version 8.8.9 p2

Related CWEs

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (3)

https://bugzilla.zimbra.com/show_bug.cgi?id=109012

Source: cve@mitre.org

ExploitIssue TrackingThird Party Advisory

https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories

Source: nvd@nist.gov

Vendor Advisory

https://bugzilla.zimbra.com/show_bug.cgi?id=109012

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitIssue TrackingThird Party Advisory

Timeline

No history available yet.