PT-2023-22235 · Zimbra · Zimbra Collaboration

Published 2023-07-06 · Updated 2024-11-19 · CVE-2023-29381

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Zimbra Collaboration (ZCS) versions 8.8.15 through 9.0

Description An issue in Zimbra Collaboration allows a remote attacker to escalate privileges and obtain sensitive information via the password and 2FA parameters.

Recommendations For versions 8.8.15 and 9.0, consider restricting access to sensitive information and disabling the use of 2FA parameters until a patch is available. As a temporary workaround, avoid using the password parameter in affected API endpoints until the issue is resolved.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2023-29381

Affected Products

Zimbra Collaboration

References · 9

• https://wiki.zimbra.com/wiki/Security_Center · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-29381 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-29381 · Security Note
• https://t.me/cvenotify/54190 · Telegram Post
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-29381 · Note
• https://t.me/cvenotify/102181 · Telegram Post
• https://wiki.zimbra.com/wiki/Zimbra_Responsible_Disclosure_Policy · Note
• https://t.me/cvenotify/53800 · Telegram Post
• https://t.me/cibsecurity/66148 · Telegram Post