CVE-2020-35123

In Zimbra Collaboration Suite Network Edition versions < 9.0.0 P10 and 8.8.15 P17, there exists an XXE vulnerability in the saml consumer store extension, which is vulnerable to XXE attacks. This has been fixed in Zimbra Collaboration Suite Network edition 9.0.0 Patch 10 and 8.8.15 Patch 17.

CVSS v3 6.5 MEDIUM
CVSS v2.0 4.0 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

4.0^/10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:L/Au:S/C:P/I:N/A:N

Exploitability : 8.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
https://wiki.zimbra.com/wiki/Security_Center	Product
https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.15/P17	Release Notes Vendor Advisory
https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P10	Third Party Advisory Vendor Advisory
https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories	Vendor Advisory
https://wiki.zimbra.com/wiki/Security_Center	Product
https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.15/P17	Release Notes Vendor Advisory
https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P10	Third Party Advisory Vendor Advisory
https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:zimbra:collaboration::::::::
	cpe:2.3:a:zimbra:collaboration:8.8.15:-::::::
	cpe:2.3:a:zimbra:collaboration:8.8.15:p1::::::
	cpe:2.3:a:zimbra:collaboration:8.8.15:p10::::::
	cpe:2.3:a:zimbra:collaboration:8.8.15:p11::::::
	cpe:2.3:a:zimbra:collaboration:8.8.15:p12::::::
	cpe:2.3:a:zimbra:collaboration:8.8.15:p13::::::
	cpe:2.3:a:zimbra:collaboration:8.8.15:p14::::::
	cpe:2.3:a:zimbra:collaboration:8.8.15:p15::::::
	cpe:2.3:a:zimbra:collaboration:8.8.15:p16::::::
	cpe:2.3:a:zimbra:collaboration:8.8.15:p2::::::
	cpe:2.3:a:zimbra:collaboration:8.8.15:p3::::::
	cpe:2.3:a:zimbra:collaboration:8.8.15:p4::::::
	cpe:2.3:a:zimbra:collaboration:8.8.15:p5::::::
	cpe:2.3:a:zimbra:collaboration:8.8.15:p6::::::
	cpe:2.3:a:zimbra:collaboration:8.8.15:p7::::::
	cpe:2.3:a:zimbra:collaboration:8.8.15:p8::::::
	cpe:2.3:a:zimbra:collaboration:8.8.15:p9::::::
	cpe:2.3:a:zimbra:collaboration:9.0.0:-::::::
	cpe:2.3:a:zimbra:collaboration:9.0.0:p1::::::
	cpe:2.3:a:zimbra:collaboration:9.0.0:p2::::::
	cpe:2.3:a:zimbra:collaboration:9.0.0:p3::::::
	cpe:2.3:a:zimbra:collaboration:9.0.0:p4::::::
	cpe:2.3:a:zimbra:collaboration:9.0.0:p5::::::
	cpe:2.3:a:zimbra:collaboration:9.0.0:p6::::::
	cpe:2.3:a:zimbra:collaboration:9.0.0:p7::::::
	cpe:2.3:a:zimbra:collaboration:9.0.0:p8::::::
	cpe:2.3:a:zimbra:collaboration:9.0.0:p9::::::

History

21 Nov 2024, 05:26

Type	Values Removed	Values Added
References	~~() https://wiki.zimbra.com/wiki/Security_Center - Product~~	() https://wiki.zimbra.com/wiki/Security_Center - Product
References	~~() https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.15/P17 - Release Notes, Vendor Advisory~~	() https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.15/P17 - Release Notes, Vendor Advisory
References	~~() https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P10 - Third Party Advisory, Vendor Advisory~~	() https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P10 - Third Party Advisory, Vendor Advisory
References	~~() https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories - Vendor Advisory~~	() https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories - Vendor Advisory

Information

Published : 2020-12-17 04:15

Updated : 2024-11-21 05:26

NVD link : CVE-2020-35123

Mitre link : CVE-2020-35123

CVE.ORG link : CVE-2020-35123

JSON object : View

Products Affected

zimbra

collaboration

CWE

CWE-611

Improper Restriction of XML External Entity Reference

{"id": "CVE-2020-35123", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N", "authentication": "SINGLE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "published": "2020-12-17T04:15:12.840", "references": [{"url": "https://wiki.zimbra.com/wiki/Security_Center", "tags": ["Product"], "source": "cve@mitre.org"}, {"url": "https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.15/P17", "tags": ["Release Notes", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P10", "tags": ["Third Party Advisory", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://wiki.zimbra.com/wiki/Security_Center", "tags": ["Product"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.15/P17", "tags": ["Release Notes", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P10", "tags": ["Third Party Advisory", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-611"}]}], "descriptions": [{"lang": "en", "value": "In Zimbra Collaboration Suite Network Edition versions < 9.0.0 P10 and 8.8.15 P17, there exists an XXE vulnerability in the saml consumer store extension, which is vulnerable to XXE attacks. This has been fixed in Zimbra Collaboration Suite Network edition 9.0.0 Patch 10 and 8.8.15 Patch 17."}, {"lang": "es", "value": "En Zimbra Collaboration Suite Network Edition versiones anteriores a 9.0.0 P10 y versi\u00f3n 8.8.15 P17, se presenta una vulnerabilidad de tipo XXE en la extensi\u00f3n de la tienda de consumidores saml, que es vulnerable a ataques de tipo XXE. Esto ha sido corregido en la edici\u00f3n Zimbra Collaboration Suite Network versi\u00f3n 9.0.0 Parche 10 y 8.8.15 Parche 17"}], "lastModified": "2024-11-21T05:26:48.327", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:zimbra:collaboration:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E9E63F1F-29FA-401C-A4AB-A7835CCBAA3A", "versionEndExcluding": "8.8.15", "versionStartExcluding": "8.8.0"}, {"criteria": "cpe:2.3:a:zimbra:collaboration:8.8.15:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1B17C1A7-0F0A-4E7C-8C0C-0BBB0BF66C82"}, {"criteria": "cpe:2.3:a:zimbra:collaboration:8.8.15:p1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BA48C450-201C-4398-AB65-EF6F95FB0380"}, {"criteria": "cpe:2.3:a:zimbra:collaboration:8.8.15:p10:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5F759114-CF2D-48BF-8D09-EBE8D1ED1949"}, {"criteria": "cpe:2.3:a:zimbra:collaboration:8.8.15:p11:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AE8BD950-24A2-4AFF-B7EE-6EE115BD75D6"}, {"criteria": "cpe:2.3:a:zimbra:collaboration:8.8.15:p12:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C43634F5-2946-44D2-8A50-B717374A8126"}, {"criteria": "cpe:2.3:a:zimbra:collaboration:8.8.15:p13:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "20315895-5410-4B88-B2D9-E9C5D79A64DF"}, {"criteria": "cpe:2.3:a:zimbra:collaboration:8.8.15:p14:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BF405091-A832-4945-87EC-AA525F37DF91"}, {"criteria": "cpe:2.3:a:zimbra:collaboration:8.8.15:p15:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C9B6FFA8-CFD2-47C6-9475-79210CB9AA84"}, {"criteria": "cpe:2.3:a:zimbra:collaboration:8.8.15:p16:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "964CA714-937C-4FC0-A1E9-07F846C786BD"}, {"criteria": "cpe:2.3:a:zimbra:collaboration:8.8.15:p2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "37BC4DF5-D111-4295-94FC-AA8929CDF2A1"}, {"criteria": "cpe:2.3:a:zimbra:collaboration:8.8.15:p3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "21768A61-7578-4EEC-A23B-FEC10CAA9EDF"}, {"criteria": "cpe:2.3:a:zimbra:collaboration:8.8.15:p4:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "661403E7-1D65-4710-8413-47D74FF65BE4"}, {"criteria": "cpe:2.3:a:zimbra:collaboration:8.8.15:p5:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0695D2E0-45B3-493C-BA6D-471B90C0ACC5"}, {"criteria": "cpe:2.3:a:zimbra:collaboration:8.8.15:p6:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "714FAFE6-68AE-4304-B040-48BC46F85A2D"}, {"criteria": "cpe:2.3:a:zimbra:collaboration:8.8.15:p7:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "73FC2D2D-8BBD-4259-8B35-0D9BFA40567B"}, {"criteria": "cpe:2.3:a:zimbra:collaboration:8.8.15:p8:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AB97E9E6-CC4A-458D-B731-6D51130B942C"}, {"criteria": "cpe:2.3:a:zimbra:collaboration:8.8.15:p9:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BA688C43-846A-4C4A-AEDB-113D967D3D73"}, {"criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "685D9652-2934-4C13-8B36-40582C79BFC1"}, {"criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BDE59185-B917-4A81-8DE4-C65A079F52FE"}, {"criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "12D0D469-6C9B-4B66-9581-DC319773238A"}, {"criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C52705E6-2C6B-47BC-A0CD-F6AAE0BFC302"}, {"criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p4:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "33F50D8C-7027-4A8D-8E95-98C224283772"}, {"criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p5:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "82000BA4-1781-4312-A7BD-92EC94D137AE"}, {"criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p6:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4B52D301-2559-457A-8FFB-F0915299355A"}, {"criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p7:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7215AE2C-8A33-4AB9-88D5-7C8CD11E806C"}, {"criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p8:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CDC810C7-45DA-4BDF-9138-2D3B2750243E"}, {"criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p9:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E09D95A4-764D-4E0B-8605-1D94FD548AB2"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}

6.5 /10

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

4.0 /10

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

JSON object

Attach tags to CVE-2020-35123

6.5^/10

4.0^/10

Attach tags to `CVE-2020-35123`