CVE-2022-32294: Critical severity zimbra collaboration suite vulnerability

Published Jul 11, 2022

Updated

DISPUTED Zimbra Collaboration Open Source 8.8.15 does not encrypt the initial-login randomly created password (from the "zmprove ca" command). It is visible in cleartext on port UDP 514 (aka the syslog port). NOTE: a third party reports that this cannot be reproduced.

Affected Software

1 affected component

Zimbra Collaboration=8.8.15

Event History

Jul 11, 2022

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Disputed

03:15 AM

Frequently Asked Questions

What is CVE-2022-32294?

CVE-2022-32294 is a vulnerability in Zimbra Collaboration Open Source 8.8.15 that allows the initial-login randomly created password to be visible in cleartext on port UDP 514.

What is the severity of CVE-2022-32294?

The severity of CVE-2022-32294 is critical with a CVSS score of 9.8.

How does CVE-2022-32294 affect Zimbra Collaboration Open Source 8.8.15?

CVE-2022-32294 affects Zimbra Collaboration Open Source 8.8.15 by not encrypting the initial-login randomly created password, making it visible in cleartext on port UDP 514.

How can I fix CVE-2022-32294 in Zimbra Collaboration Open Source 8.8.15?

There is currently no known fix for CVE-2022-32294 in Zimbra Collaboration Open Source 8.8.15.

What is CWE-863?

CWE-863 is a weakness classification related to incorrect authorization.