« Back to list

CVE-2018-15131

Status: ModifiedMedium (5.3)—💥 PoC

An issue was discovered in Synacor Zimbra Collaboration Suite 8.6.x before 8.6.0 Patch 11, 8.7.x before 8.7.11 Patch 6, 8.8.x before 8.8.8 Patch 9, and 8.8.9 before 8.8.9 Patch 3. Account number enumeration is possible via inconsistent responses for specific types of authentication requests.

CVSS

Exploitation probability (EPSS)

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

💥 Public exploits

Exploit code or detection templates are publicly available. This is not the same as confirmed active exploitation (KEV), but it raises the risk: patch with priority.

⚠️ GitHub proofs of concept are not verified: some are fake or contain malware. Never run them outside an isolated lab.

Affected technologies (1)

Synacor — Zimbra Collaboration Suite

CWEs

References

Raw JSON (NVD)

Show
{
  "id": "CVE-2018-15131",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 5.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2019-05-30T16:29:00.980",
  "references": [
    {
      "url": "https://bugzilla.zimbra.com/show_bug.cgi?id=109012",
      "tags": [
        "Exploit",
        "Issue Tracking",
        "Third Party Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "nvd@nist.gov"
    },
    {
      "url": "https://bugzilla.zimbra.com/show_bug.cgi?id=109012",
      "tags": [
        "Exploit",
        "Issue Tracking",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "An issue was discovered in Synacor Zimbra Collaboration Suite 8.6.x before 8.6.0 Patch 11, 8.7.x before 8.7.11 Patch 6, 8.8.x before 8.8.8 Patch 9, and 8.8.9 before 8.8.9 Patch 3. Account number enumeration is possible via inconsistent responses for specific types of authentication requests."
    },
    {
      "lang": "es",
      "value": "Fue encontrado un problema en Synacor Zimbra Collaboration Suite versión 8.6.x anterior a la 8.6.0 Patch 11, versión 8.7.x anterior a la 8.7.11 Patch 6, versión 8.8.x anterior a la 8.8.8 Patch 9 y versión 8.8.9 anterior a la 8.8.9 Patch 3. La enumeración del número de cuenta es posible por medio de respuestas inconsistentes para algunos tipos específicos de peticiones de autenticación."
    }
  ],
  "lastModified": "2026-06-17T01:42:06.120",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9A91CE8F-5E21-459E-A253-A1706357B82B",
              "versionEndExcluding": "8.7.11",
              "versionStartIncluding": "8.7.0"
            },
            {
              "criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "48C99285-82BF-4C22-991C-D3742B19AFED",
              "versionEndExcluding": "8.8.8",
              "versionStartIncluding": "8.8.0"
            },
            {
              "criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.6.0:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "09016525-12F2-49D0-A803-E38294FE3EFC"
            },
            {
              "criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.6.0:p1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A640E533-4AB8-4DBA-B59C-3CCDE507155F"
            },
            {
              "criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.6.0:p10:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0557E4A7-8D49-4B68-8DA1-BADCC319E465"
            },
            {
              "criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.6.0:p2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EFFA097D-1FAC-41A9-BF40-004BBE4F4777"
            },
            {
              "criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.6.0:p3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "957B3D6D-DDA6-4770-B8B1-8CDF95E87140"
            },
            {
              "criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.6.0:p4:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E48E062A-8658-4006-856E-CBABE57FE00C"
            },
            {
              "criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.6.0:p5:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C611DEE3-3574-4DCB-90F7-E80831365662"
            },
            {
              "criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.6.0:p6:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "64824D2C-D71F-49AB-83E7-C26359DF81A8"
            },
            {
              "criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.6.0:p8:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E3008B5E-3E4E-47DE-972E-443BF3528EAD"
            },
            {
              "criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.6.0:p9:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8540B665-7DB1-47ED-BCDC-D9993A3516AE"
            },
            {
              "criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.7.11:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A98A1461-959C-4FC5-8860-76C3A9605F41"
            },
            {
              "criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.7.11:p1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F64CBF7B-63AB-4523-84B9-D86F64DAB4BB"
            },
            {
              "criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.7.11:p2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D411A60B-BFA0-4B47-BF7B-D21AAFFC9E55"
            },
            {
              "criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.7.11:p3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0ADC2E0E-9365-46AA-85AC-DF2B5C791833"
            },
            {
              "criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.7.11:p4:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5ADA2C87-BDA0-485B-8BF3-EE1E1DC1C4BC"
            },
            {
              "criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.7.11:p5:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E28795C8-62FF-4C68-A469-8A2AD309E28B"
            },
            {
              "criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.8:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5463E3D4-4C0F-4CCC-ACC3-670E4F7B3BC7"
            },
            {
              "criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.8:p1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C251F5AE-592B-4D83-BBE1-A56D96F56DCC"
            },
            {
              "criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.8:p2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "28812A1D-D755-4BF5-A719-A50A12677CD3"
            },
            {
              "criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.8:p3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D5C2A832-8914-4239-A423-2F2D58E0A6D3"
            },
            {
              "criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.8:p4:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D17D7685-458A-420D-BE30-D09ADE4E5F39"
            },
            {
              "criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.8:p5:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "04C7D39A-FFAE-47C7-81B4-6CDC5A646045"
            },
            {
              "criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.8:p6:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "37D0D4D8-8BB5-45B1-897B-1D9099F8A5BA"
            },
            {
              "criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.8:p7:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B8464B0A-5584-4A05-BB47-6F29068B7C23"
            },
            {
              "criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.9:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "01E60F13-49E8-45C7-80D0-3FE174C26AA4"
            },
            {
              "criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.9:p1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7721C638-63F3-4FB4-9DBC-7781A16EDEB0"
            },
            {
              "criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.9:p2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B1FFA288-70EA-4A51-911A-C79E3359EAD5"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}