Vulnerability Details CVE-2018-10949
mailboxd in Zimbra Collaboration Suite 8.8 before 8.8.8; 8.7 before 8.7.11.Patch3; and 8.6 allows Account Enumeration by leveraging a Discrepancy between the "HTTP 404 - account is not active" and "HTTP 401 - must authenticate" errors.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.093
EPSS Ranking 92.4%
CVSS Severity
CVSS v3 Score 5.3
CVSS v2 Score 5.0
References
Products affected by CVE-2018-10949
-
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.6.0
-
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.7.0
-
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.7.1
-
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.7.10
-
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.7.11
-
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.7.2
-
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.7.3
-
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.7.4
-
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.7.5
-
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.7.6
-
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.7.7
-
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.7.8
-
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.7.9
-
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.0
-
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.2
-
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.3
-
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.4
-
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.5
-
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.6
-
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.7