PT-2020-11967 · Zimbra · Zimbra

Sneha-Patil-Synacor · Published 2020-03-20 · Updated 2021-07-21 · CVE-2020-10194

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Zimbra zm-mailbox versions prior to 8.8.15.p8

Description The issue allows authenticated users to request any GAL account, differing from the intended behavior where the domain of the authenticated user must match the domain of the galsync account in the request. This is due to a problem in the cs/service/account/AutoCompleteGal.java file.

Recommendations For versions prior to 8.8.15.p8, update to version 8.8.15.p8 or later to resolve the issue. As a temporary workaround, consider restricting access to the GAL account request functionality to minimize the risk of exploitation.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2020-10194

Affected Products

Zimbra

References · 6

• https://github.com/Zimbra/zm-mailbox/commit/1df440e0efa624d1772a05fb6d397d9beb4bda1e · Patch
• https://github.com/Zimbra/zm-mailbox/pull/1020 · Patch
• https://github.com/Zimbra/zm-mailbox/compare/8.8.15.p7...8.8.15.p8 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2020-10194 · Security Note
• https://osv.dev/vulnerability/CVE-2020-10194 · Vendor Advisory
• https://t.me/cvenotify/1976 · Telegram Post