TI-2022-13998 Aliases CVE-2022-32294 GHSA-9533-x7q2-r9j9

Zimbra Collaboration Open Source 8.8.15 does not encrypt the initial-login randomly…

MEDIUM 54CWE-863Published 2022-07-11 · Updated 2024-08-03

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: High · High · High
Fix status: No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-863.

Summary

Zimbra Collaboration Open Source 8.8.15 does not encrypt the initial-login randomly created password (from the "zmprove ca" command). It is visible in cleartext on port UDP 514 (aka the syslog port). NOTE: a third party reports that this cannot be reproduced.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.02521 84th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA

— Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:zimbra:collaboration:8.8.15::::open_source:::	8.8.15	Vulnerable	Zimbra

cpe:2.3:a:zimbra:collaboration:8.8.15:*:*:*:open_source:*:*:* Versions 8.8.15 Vulnerable ·Zimbra

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2022-32294
2026-10-03 Alias added: GHSA-9533-x7q2-r9j9

References

Advisory 4

Other 1

https://medium.com/%40soheil.samanabadi/zimbra-8-8-15-zmprove-ca-command-incorrect-access-control-8088032638e

TI-2024-18266 An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0. KEVCVSS 3.1MEDIUM 6.1
TI-2024-30553 An issue was discovered in Zimbra Collaboration (ZCS) 10.1.x before 10.1.1, 10.0.x before… CVSS 3.1HIGH 8.8
TI-2023-13772 An issue in Zimbra Collaboration ZCS v.8.8.15 and v.9.0 allows an attacker to execute… CVSS 3.1CRITICAL 9.8
TI-2023-13771 An issue in Zimbra Collaboration (ZCS) v.8.8.15 and v.9.0 allows a remote attacker to… CVSS 3.1CRITICAL 9.8
TI-2023-27722 Zimbra Collaboration before Kepler 9.0.0 Patch 38 GA allows DOM-based JavaScript injection in the Modern UI. CVSS 3.1CRITICAL 9.1
TI-2021-14103 An issue was discovered in ProxyServlet.java in the /proxy servlet in Zimbra… CVSS 3.1CRITICAL 9.8

See all 40 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences