Read the docs
TI-2018-10825 Aliases CVE-2018-15131GHSA-93m3-4vp5-23qr

An issue was discovered in Synacor Zimbra Collaboration Suite 8.6.x before 8.6.0 Patch…

Priority LOW 28CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
No fix listed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-200.

Summary

An issue was discovered in Synacor Zimbra Collaboration Suite 8.6.x before 8.6.0 Patch 11, 8.7.x before 8.7.11 Patch 6, 8.8.x before 8.8.8 Patch 9, and 8.8.9 before 8.8.9 Patch 3. Account number enumeration is possible via inconsistent responses for specific types of authentication requests.

Why it matters now

EPSS 0.01878 79th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 28

CPEVersionsRoleVendor
cpe:2.3:a:synacor:zimbra_collaboration_suite:*:*:*:*:*:*:*:*8.7.0 to before 8.7.11; 8.8.0 to before 8.8.8VulnerableSynacor
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.6.0:-:*:*:*:*:*:*8.6.0VulnerableSynacor
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.6.0:p1:*:*:*:*:*:*8.6.0 p1VulnerableSynacor
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.6.0:p10:*:*:*:*:*:*8.6.0 p10VulnerableSynacor
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.6.0:p2:*:*:*:*:*:*8.6.0 p2VulnerableSynacor
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.6.0:p3:*:*:*:*:*:*8.6.0 p3VulnerableSynacor
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.6.0:p4:*:*:*:*:*:*8.6.0 p4VulnerableSynacor
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.6.0:p5:*:*:*:*:*:*8.6.0 p5VulnerableSynacor
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.6.0:p6:*:*:*:*:*:*8.6.0 p6VulnerableSynacor
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.6.0:p8:*:*:*:*:*:*8.6.0 p8VulnerableSynacor
  • cpe:2.3:a:synacor:zimbra_collaboration_suite:*:*:*:*:*:*:*:* Versions 8.7.0 to before 8.7.11; 8.8.0 to before 8.8.8 Vulnerable ·Synacor
  • cpe:2.3:a:synacor:zimbra_collaboration_suite:8.6.0:-:*:*:*:*:*:* Versions 8.6.0 Vulnerable ·Synacor
  • cpe:2.3:a:synacor:zimbra_collaboration_suite:8.6.0:p1:*:*:*:*:*:* Versions 8.6.0 p1 Vulnerable ·Synacor
  • cpe:2.3:a:synacor:zimbra_collaboration_suite:8.6.0:p10:*:*:*:*:*:* Versions 8.6.0 p10 Vulnerable ·Synacor
  • cpe:2.3:a:synacor:zimbra_collaboration_suite:8.6.0:p2:*:*:*:*:*:* Versions 8.6.0 p2 Vulnerable ·Synacor
  • cpe:2.3:a:synacor:zimbra_collaboration_suite:8.6.0:p3:*:*:*:*:*:* Versions 8.6.0 p3 Vulnerable ·Synacor
  • cpe:2.3:a:synacor:zimbra_collaboration_suite:8.6.0:p4:*:*:*:*:*:* Versions 8.6.0 p4 Vulnerable ·Synacor
  • cpe:2.3:a:synacor:zimbra_collaboration_suite:8.6.0:p5:*:*:*:*:*:* Versions 8.6.0 p5 Vulnerable ·Synacor
  • cpe:2.3:a:synacor:zimbra_collaboration_suite:8.6.0:p6:*:*:*:*:*:* Versions 8.6.0 p6 Vulnerable ·Synacor
  • cpe:2.3:a:synacor:zimbra_collaboration_suite:8.6.0:p8:*:*:*:*:*:* Versions 8.6.0 p8 Vulnerable ·Synacor
Show 18 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.6.0:p9:*:*:*:*:*:*8.6.0 p9VulnerableSynacor
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.7.11:-:*:*:*:*:*:*8.7.11VulnerableSynacor
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.7.11:p1:*:*:*:*:*:*8.7.11 p1VulnerableSynacor
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.7.11:p2:*:*:*:*:*:*8.7.11 p2VulnerableSynacor
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.7.11:p3:*:*:*:*:*:*8.7.11 p3VulnerableSynacor
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.7.11:p4:*:*:*:*:*:*8.7.11 p4VulnerableSynacor
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.7.11:p5:*:*:*:*:*:*8.7.11 p5VulnerableSynacor
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.8:-:*:*:*:*:*:*8.8.8VulnerableSynacor
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.8:p1:*:*:*:*:*:*8.8.8 p1VulnerableSynacor
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.8:p2:*:*:*:*:*:*8.8.8 p2VulnerableSynacor
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.8:p3:*:*:*:*:*:*8.8.8 p3VulnerableSynacor
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.8:p4:*:*:*:*:*:*8.8.8 p4VulnerableSynacor
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.8:p5:*:*:*:*:*:*8.8.8 p5VulnerableSynacor
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.8:p6:*:*:*:*:*:*8.8.8 p6VulnerableSynacor
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.8:p7:*:*:*:*:*:*8.8.8 p7VulnerableSynacor
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.9:-:*:*:*:*:*:*8.8.9VulnerableSynacor
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.9:p1:*:*:*:*:*:*8.8.9 p1VulnerableSynacor
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.9:p2:*:*:*:*:*:*8.8.9 p2VulnerableSynacor
  • cpe:2.3:a:synacor:zimbra_collaboration_suite:8.6.0:p9:*:*:*:*:*:* Versions 8.6.0 p9 Vulnerable ·Synacor
  • cpe:2.3:a:synacor:zimbra_collaboration_suite:8.7.11:-:*:*:*:*:*:* Versions 8.7.11 Vulnerable ·Synacor
  • cpe:2.3:a:synacor:zimbra_collaboration_suite:8.7.11:p1:*:*:*:*:*:* Versions 8.7.11 p1 Vulnerable ·Synacor
  • cpe:2.3:a:synacor:zimbra_collaboration_suite:8.7.11:p2:*:*:*:*:*:* Versions 8.7.11 p2 Vulnerable ·Synacor
  • cpe:2.3:a:synacor:zimbra_collaboration_suite:8.7.11:p3:*:*:*:*:*:* Versions 8.7.11 p3 Vulnerable ·Synacor
  • cpe:2.3:a:synacor:zimbra_collaboration_suite:8.7.11:p4:*:*:*:*:*:* Versions 8.7.11 p4 Vulnerable ·Synacor
  • cpe:2.3:a:synacor:zimbra_collaboration_suite:8.7.11:p5:*:*:*:*:*:* Versions 8.7.11 p5 Vulnerable ·Synacor
  • cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.8:-:*:*:*:*:*:* Versions 8.8.8 Vulnerable ·Synacor
  • cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.8:p1:*:*:*:*:*:* Versions 8.8.8 p1 Vulnerable ·Synacor
  • cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.8:p2:*:*:*:*:*:* Versions 8.8.8 p2 Vulnerable ·Synacor
  • cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.8:p3:*:*:*:*:*:* Versions 8.8.8 p3 Vulnerable ·Synacor
  • cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.8:p4:*:*:*:*:*:* Versions 8.8.8 p4 Vulnerable ·Synacor
  • cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.8:p5:*:*:*:*:*:* Versions 8.8.8 p5 Vulnerable ·Synacor
  • cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.8:p6:*:*:*:*:*:* Versions 8.8.8 p6 Vulnerable ·Synacor
  • cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.8:p7:*:*:*:*:*:* Versions 8.8.8 p7 Vulnerable ·Synacor
  • cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.9:-:*:*:*:*:*:* Versions 8.8.9 Vulnerable ·Synacor
  • cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.9:p1:*:*:*:*:*:* Versions 8.8.9 p1 Vulnerable ·Synacor
  • cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.9:p2:*:*:*:*:*:* Versions 8.8.9 p2 Vulnerable ·Synacor

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-15131
  2. 2026-10-03 Alias added: GHSA-93m3-4vp5-23qr

References

Exploit 1

Advisory 1

  • TI-2024-30554 The postjournal service in Zimbra Collaboration (ZCS) before 8.8.15 Patch 46, 9 before… KEVCVSS 3.1CRITICAL 10.0
  • TI-2022-19841 An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0. KEVCVSS 3.1CRITICAL 9.8
  • TI-2022-17239 Zimbra Collaboration Suite (ZCS) 8.8.15 and 9.0 has mboximport functionality that… KEVCVSS 3.1CRITICAL 9.8
  • TI-2022-10792 Zimbra Collaboration (aka ZCS) 8.8.15 and 9.0 allows an unauthenticated attacker to… KEVCVSS 3.1CRITICAL 9.8
  • TI-2020-06312 Zimbra Collaboration Suite (ZCS) before 8.8.15 Patch 7 allows SSRF when WebEx zimlet is… KEVCVSS 3.1CRITICAL 9.8
  • TI-2019-07076 mailboxd component in Synacor Zimbra Collaboration Suite 8.7.x before 8.7.11p10 has an… KEVCVSS 3.1CRITICAL 9.8
See all 96 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences