CVE-2022-26562: Critical severity kopano groupware core vulnerability
An issue in provider/libserver/ECKrbAuth.cpp of Kopano Core <= v11.0.2.51 contains an issue which allows attackers to authenticate even if the user account or password is expired. It also exists in the predecessor Zarafa Collaboration Platform (ZCP) in provider/libserver/ECPamAuth.cpp of Zarafa = 6.30 (introduced between 6.30.0 RC1e and 6.30.8 final).
Other sources
An issue in provider/libserver/ECKrbAuth.cpp of Kopano-Core v11.0.2.51 contains an issue which allows attackers to authenticate even if the user account or password is expired.
References: - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-26562 - https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1016973 - https://jira.kopano.io/browse/KC-2021 - https://github.com/Kopano-dev/kopano-core/blob/master/provider/libserver/ECKrbAuth.cpp#L137
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2022-26562?
CVE-2022-26562 is classified as a critical vulnerability due to its potential for unauthorized access.
How do I fix CVE-2022-26562?
To mitigate CVE-2022-26562, update Kopano Core to version 11.0.2.52 or higher, or update Zarafa to the recommended secure versions.
What types of systems are affected by CVE-2022-26562?
CVE-2022-26562 affects Kopano Core versions up to 11.0.2.51 and Zarafa versions 7.x.
What does CVE-2022-26562 allow attackers to do?
CVE-2022-26562 allows attackers to authenticate users even if their account or password has expired.
Is there a patch available for CVE-2022-26562?
Yes, patches are available in the latest versions of Kopano Core and Zarafa.