CVE-2020-10194: Medium severity zimbra collaboration suite vulnerability
Published Mar 20, 2020
·Updated
cs/service/account/AutoCompleteGal.java in Zimbra zm-mailbox before 8.8.15.p8 allows authenticated users to request any GAL account. This differs from the intended behavior in which the domain of the authenticated user must match the domain of the galsync account in the request.
Affected Software
9 affected components
Zimbra zm-mailbox<8.8.15
Zimbra zm-mailbox=8.8.15
Zimbra zm-mailbox=8.8.15-patch1
Zimbra zm-mailbox=8.8.15-patch2
Zimbra zm-mailbox=8.8.15-patch3
Zimbra zm-mailbox=8.8.15-patch4
Zimbra zm-mailbox=8.8.15-patch5
Zimbra zm-mailbox=8.8.15-patch6
Zimbra zm-mailbox=8.8.15-patch7
Remediation
Patch Available
Event History
Mar 20, 2020
CVE Published
via MITRE·08:30 PM
Data Sourced
via MITRE·08:30 PM
Description
Frequently Asked Questions
1
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2020-10194.
2
What is the severity level of CVE-2020-10194?
The severity level of CVE-2020-10194 is medium, with a CVSS score of 6.5.
3
Which software versions are affected by CVE-2020-10194?
Versions of Zimbra zm-mailbox before 8.8.15.p8 are affected by CVE-2020-10194.
4
What is the impact of CVE-2020-10194?
CVE-2020-10194 allows authenticated users to request any GAL (Global Address List) account, bypassing the intended domain matching behavior.
5
How can I fix CVE-2020-10194?
To fix CVE-2020-10194, upgrade to Zimbra zm-mailbox version 8.8.15.p8 or later.