CVE-2018-10949

MEDIUM

Synacor Zimbra Collaboration Suite < 8.7.11 - Information Disclosure

Title source: rule
STIX 2.1

Description

mailboxd in Zimbra Collaboration Suite 8.8 before 8.8.8; 8.7 before 8.7.11.Patch3; and 8.6 allows Account Enumeration by leveraging a Discrepancy between the "HTTP 404 - account is not active" and "HTTP 401 - must authenticate" errors.

Exploits (1)

nomisec WORKING POC 1 stars
by 0x00-0x00 · poc
https://github.com/0x00-0x00/CVE-2018-10949

References (1)

Core 1
Core References
Issue Tracking, Third Party Advisory x_refsource_misc
https://bugzilla.zimbra.com/show_bug.cgi?id=108962

Scores

CVSS v3 5.3
EPSS 0.0992
EPSS Percentile 93.0%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Details

CWE
CWE-203
Status published
Products (2)
synacor/zimbra_collaboration_suite 8.6.0
synacor/zimbra_collaboration_suite 8.7.0 - 8.7.11
Published May 10, 2018
Tracked Since Feb 18, 2026