CVE-2023-38750

In Zimbra Collaboration (ZCS) 8 before 8.8.15 Patch 41, 9 before 9.0.0 Patch 34, and 10 before 10.0.2, internal JSP and XML files can be exposed.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://wiki.zimbra.com/wiki/Security_Center	Release Notes Vendor Advisory
https://wiki.zimbra.com/wiki/Zimbra_Responsible_Disclosure_Policy	Not Applicable

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:zimbra:zimbra::::::::
	cpe:2.3:a:zimbra:zimbra:8.8.15:p11::::::
	cpe:2.3:a:zimbra:zimbra:8.8.15:p26::::::
	cpe:2.3:a:zimbra:zimbra:8.8.15:p3::::::
	cpe:2.3:a:zimbra:zimbra:8.8.15:p30::::::
	cpe:2.3:a:zimbra:zimbra:8.8.15:p31::::::
	cpe:2.3:a:zimbra:zimbra:8.8.15:p32::::::
	cpe:2.3:a:zimbra:zimbra:8.8.15:p33::::::
	cpe:2.3:a:zimbra:zimbra:8.8.15:p34::::::
	cpe:2.3:a:zimbra:zimbra:8.8.15:p35::::::
	cpe:2.3:a:zimbra:zimbra:8.8.15:p37::::::
	cpe:2.3:a:zimbra:zimbra:8.8.15:p38::::::
	cpe:2.3:a:zimbra:zimbra:8.8.15:p40::::::
	cpe:2.3:a:zimbra:zimbra:8.8.15:p5::::::
	cpe:2.3:a:zimbra:zimbra:9.0.0:::::::*
	cpe:2.3:a:zimbra:zimbra:9.0.0:p0::::::
	cpe:2.3:a:zimbra:zimbra:9.0.0:p19::::::
	cpe:2.3:a:zimbra:zimbra:9.0.0:p23::::::
	cpe:2.3:a:zimbra:zimbra:9.0.0:p25::::::
	cpe:2.3:a:zimbra:zimbra:9.0.0:p26::::::
	cpe:2.3:a:zimbra:zimbra:9.0.0:p27::::::
	cpe:2.3:a:zimbra:zimbra:9.0.0:p28::::::
	cpe:2.3:a:zimbra:zimbra:9.0.0:p30::::::
	cpe:2.3:a:zimbra:zimbra:9.0.0:p31::::::
	cpe:2.3:a:zimbra:zimbra:9.0.0:p33::::::
	cpe:2.3:a:zimbra:zimbra:9.0.0:p4::::::
	cpe:2.3:a:zimbra:zimbra:9.0.0:p7::::::
	cpe:2.3:a:zimbra:zimbra:9.0.0:p7.1::::::
	cpe:2.3:a:zimbra:zimbra:10.0.1:::::::*

History

No history.

Information

Published : 2023-07-31 16:15

Updated : 2023-08-04 17:09

NVD link : CVE-2023-38750

Mitre link : CVE-2023-38750

CVE.ORG link : CVE-2023-38750

JSON object : View

Products Affected

zimbra

zimbra

CWE

NVD-CWE-noinfo

{"id": "CVE-2023-38750", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2023-07-31T16:15:10.437", "references": [{"url": "https://wiki.zimbra.com/wiki/Security_Center", "tags": ["Release Notes", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://wiki.zimbra.com/wiki/Zimbra_Responsible_Disclosure_Policy", "tags": ["Not Applicable"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "In Zimbra Collaboration (ZCS) 8 before 8.8.15 Patch 41, 9 before 9.0.0 Patch 34, and 10 before 10.0.2, internal JSP and XML files can be exposed."}], "lastModified": "2023-08-04T17:09:45.547", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:zimbra:zimbra:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "38ECDB77-75C2-4F1F-94A8-D0F7CAC58427", "versionEndExcluding": "8.8.15", "versionStartIncluding": "8.8.0"}, {"criteria": "cpe:2.3:a:zimbra:zimbra:8.8.15:p11:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D94082EB-9245-421E-A195-659ED7E97FBD"}, {"criteria": "cpe:2.3:a:zimbra:zimbra:8.8.15:p26:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F10A5925-168E-45E8-888E-E4042A1406A4"}, {"criteria": "cpe:2.3:a:zimbra:zimbra:8.8.15:p3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "074B9DC0-1700-4C29-B332-093FEA785D39"}, {"criteria": "cpe:2.3:a:zimbra:zimbra:8.8.15:p30:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "85C96088-3631-4CAE-BA6C-9E7A12EC455F"}, {"criteria": "cpe:2.3:a:zimbra:zimbra:8.8.15:p31:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BCB801E7-C9C5-42FC-A4C3-CECD9F21887B"}, {"criteria": "cpe:2.3:a:zimbra:zimbra:8.8.15:p32:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A22C14E7-34AE-438C-9E2A-DA4BF07889D5"}, {"criteria": "cpe:2.3:a:zimbra:zimbra:8.8.15:p33:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B5251B9B-87EF-4300-A791-8C2BB2B58FA8"}, {"criteria": "cpe:2.3:a:zimbra:zimbra:8.8.15:p34:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C9795188-0A57-48A6-B876-0A2477888D6F"}, {"criteria": "cpe:2.3:a:zimbra:zimbra:8.8.15:p35:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4288C356-C993-486F-B3CF-D8E44A7A53C7"}, {"criteria": "cpe:2.3:a:zimbra:zimbra:8.8.15:p37:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7A98258E-91BA-45F0-8417-6FFB3CF02FB5"}, {"criteria": "cpe:2.3:a:zimbra:zimbra:8.8.15:p38:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3EFD7BC4-0284-4551-972C-81DD7F225DA9"}, {"criteria": "cpe:2.3:a:zimbra:zimbra:8.8.15:p40:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "ACA5EA7B-95A3-49E9-A407-A034279173FB"}, {"criteria": "cpe:2.3:a:zimbra:zimbra:8.8.15:p5:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9F670A63-D8E9-4360-83CF-5C5D3D8B569E"}, {"criteria": "cpe:2.3:a:zimbra:zimbra:9.0.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B671A427-BC20-43CB-A7F1-DD2124B2B901"}, {"criteria": "cpe:2.3:a:zimbra:zimbra:9.0.0:p0:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "631ADC21-06BA-476D-B134-E25D06740019"}, {"criteria": "cpe:2.3:a:zimbra:zimbra:9.0.0:p19:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "92C99D34-300D-4AC6-9D75-538621978E38"}, {"criteria": "cpe:2.3:a:zimbra:zimbra:9.0.0:p23:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D949B9A3-4E4F-45FC-93AB-478B77C6F7AE"}, {"criteria": "cpe:2.3:a:zimbra:zimbra:9.0.0:p25:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0BDA3621-F2AA-4E55-8641-A30B9A3DCF8E"}, {"criteria": "cpe:2.3:a:zimbra:zimbra:9.0.0:p26:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3A29151F-9083-45B7-8C1E-A844372C01C0"}, {"criteria": "cpe:2.3:a:zimbra:zimbra:9.0.0:p27:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E35B7C01-F288-47D6-8C43-50FC6F6FEA7A"}, {"criteria": "cpe:2.3:a:zimbra:zimbra:9.0.0:p28:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "40687633-0902-4D3E-8C7B-AE9318EB9DAD"}, {"criteria": "cpe:2.3:a:zimbra:zimbra:9.0.0:p30:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8091130D-23B8-4271-9164-2279C14CBE7B"}, {"criteria": "cpe:2.3:a:zimbra:zimbra:9.0.0:p31:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B40F5F01-E7DC-4399-8F9E-2341069FD555"}, {"criteria": "cpe:2.3:a:zimbra:zimbra:9.0.0:p33:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C8B3E761-6A2D-4AC1-8B46-B04196135A51"}, {"criteria": "cpe:2.3:a:zimbra:zimbra:9.0.0:p4:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8A3B019E-A357-4F7E-8DB5-336B3209D130"}, {"criteria": "cpe:2.3:a:zimbra:zimbra:9.0.0:p7:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E88525DC-A672-40E8-A756-43DD3E9685CC"}, {"criteria": "cpe:2.3:a:zimbra:zimbra:9.0.0:p7.1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "482EC153-BE0F-4B8B-8AC0-0D2CC3A94752"}, {"criteria": "cpe:2.3:a:zimbra:zimbra:10.0.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0A092529-4EF6-45CC-A56B-BC9255E97F6D"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}