PT-2018-10204 · Zimbra · Zimbra Collaboration Suite

Published 2018-05-10 · Updated 2025-08-15 · CVE-2018-10951

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Zimbra Collaboration Suite versions 8.6.0 before Patch10 Zimbra Collaboration Suite versions 8.7.0 through 8.7.11.Patch2 Zimbra Collaboration Suite versions 8.8.0 through 8.8.7

Description The issue allows read access to zimbraSSLPrivateKey via a "GetServer", "GetAllServers", or "GetAllActiveServers" call in the Admin SOAP API, specifically through endpoints like "/AdminSOAP" or similar. This could potentially lead to unauthorized access to sensitive information.

Recommendations For Zimbra Collaboration Suite version 8.6.0 before Patch10, update to at least Patch10. For Zimbra Collaboration Suite version 8.7.0 through 8.7.11.Patch2, update to at least 8.7.11.Patch3. For Zimbra Collaboration Suite version 8.8.0 through 8.8.7, update to at least 8.8.8.

Fix

Related Identifiers

CVE-2018-10951

Affected Products

Zimbra Collaboration Suite

References · 5

• https://osv.dev/vulnerability/CVE-2018-10951 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-10951 · Security Note
• https://bugzilla.zimbra.com/show_bug.cgi?id=108894 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10951 · Note
• https://t.me/cveNotify/132522 · Telegram Post