PT-2023-2844 · Zimbra · Zimbra Collaboration

Published 2023-02-21 · Updated 2024-10-28 · CVE-2023-26562

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Zimbra Collaboration (ZCS) versions 8.8.15 through 9.0

Description The issue is related to a lack of account status check when sending emails using 2FA (two-factor authentication) in Zimbra Collaboration Suite. This can allow a remote attacker to elevate their privileges. A closed account with 2FA and generated passwords can send email messages when configured for Imap/smtp.

Recommendations For Zimbra Collaboration (ZCS) versions 8.8.15 through 9.0, consider disabling the Imap/smtp configuration for closed accounts as a temporary workaround until a patch is available. Restrict access to email sending functionality for accounts with 2FA and generated passwords to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authorization

Weakness Enumeration

CWE-862

CWE-254

Related Identifiers

BDU:2023-02789

CVE-2023-26562

Affected Products

Zimbra Collaboration

References · 11

• https://bdu.fstec.ru/vul/2023-02789 · Security Note
• https://osv.dev/vulnerability/CVE-2023-26562 · Vendor Advisory
• https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-26562 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-26562 · Note
• https://t.me/cvenotify/99741 · Telegram Post
• https://wiki.zimbra.com/wiki/Security_Center · Note
• https://twitter.com/CVEnew/status/1757432716566696368 · Twitter Post
• https://t.me/cvenotify/99021 · Telegram Post
• https://wiki.zimbra.com/wiki/Zimbra_Responsible_Disclosure_Policy · Note
• https://twitter.com/VulmonFeeds/status/1757473796909367580 · Twitter Post