CVE-2020-10194

cs/service/account/AutoCompleteGal.java in Zimbra zm-mailbox before 8.8.15.p8 allows authenticated users to request any GAL account

published March 20, 2020

CVSS
—
EPSS
1%
Percentile
68.2
In the wild
Unconfirmed
What it is

cs/service/account/AutoCompleteGal.java in Zimbra zm-mailbox before 8.8.15.p8 allows authenticated users to request any GAL account. This differs from the intended behavior in which the domain of the authenticated user must match the domain of the galsync account in the request.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01210 · 68.2th percentile
Published
2020-03-20T20:30Z
EPSS history
Timeline
  • 20 MAR 20:30Z
    cs/service/account/AutoCompleteGal.java in Zimbra zm-mailbox before 8.8.15.p8 allows authenticated users to request any GAL account
    cvelistv5