VYPR
← All advisories
Medium severity5.3OSV Advisory· Published May 10, 2018· Updated Jun 17, 2026

CVE-2018-10949

CVE-2018-10949

Description

mailboxd in Zimbra Collaboration Suite 8.8 before 8.8.8; 8.7 before 8.7.11.Patch3; and 8.6 allows Account Enumeration by leveraging a Discrepancy between the "HTTP 404 - account is not active" and "HTTP 401 - must authenticate" errors.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

4
  • Zimbra/Zm BuildOSV
    Range: 8.7.10, 8.7.11, 8.7.6, …
  • VMware/Zimbra Collaboration Suite2 versions
    cpe:2.3:a:synacor:zimbra_collaboration_suite:*:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:synacor:zimbra_collaboration_suite:*:*:*:*:*:*:*:*range: >=8.7.0,<=8.7.11
    • cpe:2.3:a:synacor:zimbra_collaboration_suite:8.6.0:*:*:*:*:*:*:*
  • Zimbra/Collaboration Serverllm-fuzzy
    Range: <8.8.8 || <8.7.11.Patch3 || 8.6

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.