CVE-2018-15131

Severity: medium (CVSS 5.3 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.9% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2019-05-30 · updated 2026-06-17
Weakness: CWE-200

Description

An issue was discovered in Synacor Zimbra Collaboration Suite 8.6.x before 8.6.0 Patch 11, 8.7.x before 8.7.11 Patch 6, 8.8.x before 8.8.8 Patch 9, and 8.8.9 before 8.8.9 Patch 3. Account number enumeration is possible via inconsistent responses for specific types of authentication requests.

Affected products

Zimbra Collaboration: from 8.7.0 before 8.7.11; from 8.8.0 before 8.8.8; 8.6.0, 8.6.0-p1, 8.6.0-p10, 8.6.0-p2, 8.6.0-p3, 8.6.0-p4 (+21) — fixed in 8.7.11, 8.8.8

How to fix

Upgrade to a fixed version: Zimbra Collaboration 8.7.11, 8.8.8. Check the vendor advisory for mitigations.

References

https://bugzilla.zimbra.com/show_bug.cgi?id=109012
https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories
https://bugzilla.zimbra.com/show_bug.cgi?id=109012

Get alerted when CVE-2018-15131 or the next vulnerability affects your stack