CVE-2020-35123 - NVD | ByteOS Network

NVD Vulnerability Details :

CVE-2020-35123

Analyzed

More Info Official Page

Source-cve@mitre.org

Published At-17 Dec, 2020 | 04:15

Updated At-22 Dec, 2020 | 17:26

In Zimbra Collaboration Suite Network Edition versions < 9.0.0 P10 and 8.8.15 P17, there exists an XXE vulnerability in the saml consumer store extension, which is vulnerable to XXE attacks. This has been fixed in Zimbra Collaboration Suite Network edition 9.0.0 Patch 10 and 8.8.15 Patch 17.

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	6.5	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Primary	2.0	4.0	MEDIUM	AV:N/AC:L/Au:S/C:P/I:N/A:N

CPE Matches

>>collaboration>>Versions between 8.8.0(exclusive) and 8.8.15(exclusive)

cpe:2.3:a:zimbra:collaboration:*:*:*:*:*:*:*:*

>>collaboration>>8.8.15

cpe:2.3:a:zimbra:collaboration:8.8.15:-:*:*:*:*:*:*

>>collaboration>>8.8.15

cpe:2.3:a:zimbra:collaboration:8.8.15:p1:*:*:*:*:*:*

>>collaboration>>8.8.15

cpe:2.3:a:zimbra:collaboration:8.8.15:p10:*:*:*:*:*:*

>>collaboration>>8.8.15

cpe:2.3:a:zimbra:collaboration:8.8.15:p11:*:*:*:*:*:*

>>collaboration>>8.8.15

cpe:2.3:a:zimbra:collaboration:8.8.15:p12:*:*:*:*:*:*

>>collaboration>>8.8.15

cpe:2.3:a:zimbra:collaboration:8.8.15:p13:*:*:*:*:*:*

>>collaboration>>8.8.15

cpe:2.3:a:zimbra:collaboration:8.8.15:p14:*:*:*:*:*:*

>>collaboration>>8.8.15

cpe:2.3:a:zimbra:collaboration:8.8.15:p15:*:*:*:*:*:*

>>collaboration>>8.8.15

cpe:2.3:a:zimbra:collaboration:8.8.15:p16:*:*:*:*:*:*

>>collaboration>>8.8.15

cpe:2.3:a:zimbra:collaboration:8.8.15:p2:*:*:*:*:*:*

>>collaboration>>8.8.15

cpe:2.3:a:zimbra:collaboration:8.8.15:p3:*:*:*:*:*:*

>>collaboration>>8.8.15

cpe:2.3:a:zimbra:collaboration:8.8.15:p4:*:*:*:*:*:*

>>collaboration>>8.8.15

cpe:2.3:a:zimbra:collaboration:8.8.15:p5:*:*:*:*:*:*

>>collaboration>>8.8.15

cpe:2.3:a:zimbra:collaboration:8.8.15:p6:*:*:*:*:*:*

>>collaboration>>8.8.15

cpe:2.3:a:zimbra:collaboration:8.8.15:p7:*:*:*:*:*:*

>>collaboration>>8.8.15

cpe:2.3:a:zimbra:collaboration:8.8.15:p8:*:*:*:*:*:*

>>collaboration>>8.8.15

cpe:2.3:a:zimbra:collaboration:8.8.15:p9:*:*:*:*:*:*

>>collaboration>>9.0.0

cpe:2.3:a:zimbra:collaboration:9.0.0:-:*:*:*:*:*:*

>>collaboration>>9.0.0

cpe:2.3:a:zimbra:collaboration:9.0.0:p1:*:*:*:*:*:*

>>collaboration>>9.0.0

cpe:2.3:a:zimbra:collaboration:9.0.0:p2:*:*:*:*:*:*

>>collaboration>>9.0.0

cpe:2.3:a:zimbra:collaboration:9.0.0:p3:*:*:*:*:*:*

>>collaboration>>9.0.0

cpe:2.3:a:zimbra:collaboration:9.0.0:p4:*:*:*:*:*:*

>>collaboration>>9.0.0

cpe:2.3:a:zimbra:collaboration:9.0.0:p5:*:*:*:*:*:*

>>collaboration>>9.0.0

cpe:2.3:a:zimbra:collaboration:9.0.0:p6:*:*:*:*:*:*

>>collaboration>>9.0.0

cpe:2.3:a:zimbra:collaboration:9.0.0:p7:*:*:*:*:*:*

>>collaboration>>9.0.0

cpe:2.3:a:zimbra:collaboration:9.0.0:p8:*:*:*:*:*:*

>>collaboration>>9.0.0

cpe:2.3:a:zimbra:collaboration:9.0.0:p9:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-611	Primary	nvd@nist.gov

References

Hyperlink	Source	Resource
https://wiki.zimbra.com/wiki/Security_Center	cve@mitre.org	Product
https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.15/P17	cve@mitre.org	Release Notes Vendor Advisory
https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P10	cve@mitre.org	Third Party Advisory Vendor Advisory
https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories	cve@mitre.org	Vendor Advisory