CVE-2018-10949

mailboxd in Zimbra Collaboration Suite 8.8 before 8.8.8; 8.7 before 8.7.11.Patch3; and 8.6 allows Account Enumeration by leveraging a Discrepancy between the "HTTP 404 - account is not active" and "HTTP 401 - must authenticate" errors.
References
Link Resource
https://bugzilla.zimbra.com/show_bug.cgi?id=108962 Issue Tracking Third Party Advisory
Configurations

Configuration 1

cpe:2.3:a:synacor:zimbra_collaboration_suite:8.6.0:*:*:*:*:*:*:*
cpe:2.3:a:synacor:zimbra_collaboration_suite:*:*:*:*:*:*:*:*
cpe:2.3:a:synacor:zimbra_collaboration_suite:*:*:*:*:*:*:*:*

Information

Published : 2018-05-10 01:29

Updated : 2020-08-24 05:37


NVD link : CVE-2018-10949

Mitre link : CVE-2018-10949

Products Affected
No products.
CWE