CVE-2023-50444

Vulnerability

By default, .ZED containers produced by PRIMX ZED! for Windows before Q.2020.3, ZED! for Windows before Q.2021.2, ZONECENTRAL for Windows before Q.2021.2 and before 2023.5, ZEDMAIL for Windows before 2023.5, and ZED! for Windows, Mac, Linux before 2023.5 include an encrypted version of sensitive user information. An unauthenticated attacker can obtain this information via brute force.

Exploitation

No authentication or user interaction is required. The attacker can access the .ZED container over the network and perform brute-force attacks on the encrypted metadata. The attack complexity is high due to the encryption, but weak user passwords make the attack feasible.

Impact

Successful exploitation leads to disclosure of sensitive user information. The confidentiality impact is high; integrity and availability are not affected. The scope of the attack is changed, meaning the compromise affects resources beyond the initial container.

Mitigation

Upgrade to a fixed version: ZED! Enterprise for Windows Q.2020.3 (ANSSI validated), Q.2021.2 (ANSSI validated), or minimal version 2023.5; ZONECENTRAL for Windows Q.2021.2 (ANSSI validated) or minimal version 2023.5; ZEDMAIL for Windows minimal version 2023.5 [2]. No workaround is available. Use strong passwords to reduce brute-force risk.