CVE-2020-10194

Опубликовано: 20 мар. 2020

Источник: nvd

CVSS3: 6.5

CVSS2: 4

EPSS Низкий

Описание

cs/service/account/AutoCompleteGal.java in Zimbra zm-mailbox before 8.8.15.p8 allows authenticated users to request any GAL account. This differs from the intended behavior in which the domain of the authenticated user must match the domain of the galsync account in the request.

Ссылки

https://github.com/Zimbra/zm-mailbox/commit/1df440e0efa624d1772a05fb6d397d9beb4bda1e
Patch
Third Party Advisory
https://github.com/Zimbra/zm-mailbox/compare/8.8.15.p7...8.8.15.p8
Patch
Third Party Advisory
https://github.com/Zimbra/zm-mailbox/pull/1020
Patch
Third Party Advisory
https://github.com/Zimbra/zm-mailbox/commit/1df440e0efa624d1772a05fb6d397d9beb4bda1e
Patch
Third Party Advisory
https://github.com/Zimbra/zm-mailbox/compare/8.8.15.p7...8.8.15.p8
Patch
Third Party Advisory
https://github.com/Zimbra/zm-mailbox/pull/1020
Patch
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:zimbra:zm-mailbox:*:*:*:*:*:*:*:*

Версия до 8.8.15 (исключая)

cpe:2.3:a:zimbra:zm-mailbox:8.8.15:-:*:*:*:*:*:*

cpe:2.3:a:zimbra:zm-mailbox:8.8.15:patch1:*:*:*:*:*:*

cpe:2.3:a:zimbra:zm-mailbox:8.8.15:patch2:*:*:*:*:*:*

cpe:2.3:a:zimbra:zm-mailbox:8.8.15:patch3:*:*:*:*:*:*

cpe:2.3:a:zimbra:zm-mailbox:8.8.15:patch4:*:*:*:*:*:*

cpe:2.3:a:zimbra:zm-mailbox:8.8.15:patch5:*:*:*:*:*:*

cpe:2.3:a:zimbra:zm-mailbox:8.8.15:patch6:*:*:*:*:*:*

cpe:2.3:a:zimbra:zm-mailbox:8.8.15:patch7:*:*:*:*:*:*

EPSS

Процентиль: 47%

0.0024

Низкий

6.5 Medium

CVSS3

4 Medium

CVSS2

Дефекты

CWE-862

Связанные уязвимости

GHSA-72wm-wxqm-26cv

github

больше 3 лет назад