6.5
CVE-2020-10194
- EPSS 0.24%
- Veröffentlicht 20.03.2020 21:15:17
- Zuletzt bearbeitet 21.11.2024 04:54:56
- Quelle cve@mitre.org
- CVE-Watchlists
- Unerledigt
Logincs/service/account/AutoCompleteGal.java in Zimbra zm-mailbox before 8.8.15.p8 allows authenticated users to request any GAL account. This differs from the intended behavior in which the domain of the authenticated user must match the domain of the galsync account in the request.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Zimbra ≫ Zm-mailbox Version < 8.8.15
Zimbra ≫ Zm-mailbox Version8.8.15 Update-
Zimbra ≫ Zm-mailbox Version8.8.15 Updatepatch1
Zimbra ≫ Zm-mailbox Version8.8.15 Updatepatch2
Zimbra ≫ Zm-mailbox Version8.8.15 Updatepatch3
Zimbra ≫ Zm-mailbox Version8.8.15 Updatepatch4
Zimbra ≫ Zm-mailbox Version8.8.15 Updatepatch5
Zimbra ≫ Zm-mailbox Version8.8.15 Updatepatch6
Zimbra ≫ Zm-mailbox Version8.8.15 Updatepatch7
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.24% | 0.445 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 6.5 | 2.8 | 3.6 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
|
| nvd@nist.gov | 4 | 8 | 2.9 |
AV:N/AC:L/Au:S/C:N/I:P/A:N
|
CWE-862 Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.