PT-2018-10204 · Zimbra · Zimbra Collaboration Suite

CVE-2018-10951 · Publicado 2018-05-10 · Atualizado 2025-08-15

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Zimbra Collaboration Suite versions 8.6.0 before Patch10 Zimbra Collaboration Suite versions 8.7.0 through 8.7.11.Patch2 Zimbra Collaboration Suite versions 8.8.0 through 8.8.7

Description The issue allows read access to zimbraSSLPrivateKey via a "GetServer", "GetAllServers", or "GetAllActiveServers" call in the Admin SOAP API, specifically through endpoints like "/AdminSOAP" or similar. This could potentially lead to unauthorized access to sensitive information.

Recommendations For Zimbra Collaboration Suite version 8.6.0 before Patch10, update to at least Patch10. For Zimbra Collaboration Suite version 8.7.0 through 8.7.11.Patch2, update to at least 8.7.11.Patch3. For Zimbra Collaboration Suite version 8.8.0 through 8.8.7, update to at least 8.8.8.

Correção

Identificadores relacionados

CVE-2018-10951

Produtos afetados

Zimbra Collaboration Suite

Referências · 5

• https://osv.dev/vulnerability/CVE-2018-10951 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-10951 · Nota de Segurança
• https://bugzilla.zimbra.com/show_bug.cgi?id=108894 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10951 · Nota
• https://t.me/cveNotify/132522 · Publicação no Telegram