CVE-2020-10194

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2020-10194
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-10194.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2020-10194
Published
2020-03-20T21:15:17.047Z
Modified
2026-07-08T20:30:09.188419Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N CVSS Calculator
Summary
[none]
Details

cs/service/account/AutoCompleteGal.java in Zimbra zm-mailbox before 8.8.15.p8 allows authenticated users to request any GAL account. This differs from the intended behavior in which the domain of the authenticated user must match the domain of the galsync account in the request.

References

Affected packages

Git / github.com/zimbra/zm-mailbox

Affected ranges

Type
GIT
Repo
https://github.com/zimbra/zm-mailbox
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
d30e647f21ecef5490f21facf2e06e228b44a36e
Introduced
d30e647f21ecef5490f21facf2e06e228b44a36e
Last affected
a12b964a206748de6db6dc1da2ee16249aabafce
Fixed
1df440e0efa624d1772a05fb6d397d9beb4bda1e
Database specific 
{
    "cpe": [
        "cpe:2.3:a:zimbra:zm-mailbox:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:zimbra:zm-mailbox:8.8.15:-:*:*:*:*:*:*",
        "cpe:2.3:a:zimbra:zm-mailbox:8.8.15:patch1:*:*:*:*:*:*",
        "cpe:2.3:a:zimbra:zm-mailbox:8.8.15:patch2:*:*:*:*:*:*",
        "cpe:2.3:a:zimbra:zm-mailbox:8.8.15:patch3:*:*:*:*:*:*",
        "cpe:2.3:a:zimbra:zm-mailbox:8.8.15:patch4:*:*:*:*:*:*",
        "cpe:2.3:a:zimbra:zm-mailbox:8.8.15:patch5:*:*:*:*:*:*",
        "cpe:2.3:a:zimbra:zm-mailbox:8.8.15:patch6:*:*:*:*:*:*",
        "cpe:2.3:a:zimbra:zm-mailbox:8.8.15:patch7:*:*:*:*:*:*"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "8.8.15"
        },
        {
            "introduced": "8.8.15-NA"
        },
        {
            "last_affected": "8.8.15-NA"
        },
        {
            "introduced": "8.8.15-patch1"
        },
        {
            "last_affected": "8.8.15-patch1"
        },
        {
            "introduced": "8.8.15-patch2"
        },
        {
            "last_affected": "8.8.15-patch2"
        },
        {
            "introduced": "8.8.15-patch3"
        },
        {
            "last_affected": "8.8.15-patch3"
        },
        {
            "introduced": "8.8.15-patch4"
        },
        {
            "last_affected": "8.8.15-patch4"
        },
        {
            "introduced": "8.8.15-patch5"
        },
        {
            "last_affected": "8.8.15-patch5"
        },
        {
            "introduced": "8.8.15-patch6"
        },
        {
            "last_affected": "8.8.15-patch6"
        },
        {
            "introduced": "8.8.15-patch7"
        },
        {
            "last_affected": "8.8.15-patch7"
        }
    ],
    "source": [
        "CPE_RANGE",
        "CPE_STRING",
        "REFERENCES"
    ]
}

Affected versions

8.*
8.8.10
8.8.12
8.8.15
8.8.15-NA
8.8.15-patch1
8.8.15-patch2
8.8.15-patch3
8.8.15-patch4
8.8.15-patch5
8.8.15-patch6
8.8.15-patch7
8.8.15.p1
8.8.15.p2
8.8.15.p3
8.8.15.p4
8.8.15.p5
8.8.15.p6
8.8.15.p7
8.8.2
8.8.3
8.8.4
8.8.5
8.8.6
8.8.7
8.8.8
8.8.9

Database specific

vanir_signatures 
[
    {
        "source": "https://github.com/zimbra/zm-mailbox/commit/d30e647f21ecef5490f21facf2e06e228b44a36e",
        "signature_version": "v1",
        "signature_type": "Function",
        "digest": {
            "function_hash": "130804680382483964301386928646396783356",
            "length": 461.0
        },
        "deprecated": false,
        "id": "CVE-2020-10194-4314dc38",
        "target": {
            "function": "updateLastLogon",
            "file": "store/src/java/com/zimbra/cs/account/ldap/LdapProvisioning.java"
        }
    },
    {
        "source": "https://github.com/zimbra/zm-mailbox/commit/1df440e0efa624d1772a05fb6d397d9beb4bda1e",
        "signature_version": "v1",
        "signature_type": "Line",
        "digest": {
            "line_hashes": [
                "229517679686205523715402217324700394259",
                "56981330284956748620401296164109700603",
                "336897459929083016848280167708331261784",
                "87588029407074370430861276684829618465",
                "103335325727630520655163700639494496382",
                "253093700081280273806403364256489052188"
            ],
            "threshold": 0.9
        },
        "deprecated": false,
        "id": "CVE-2020-10194-81b4ab0b",
        "target": {
            "file": "store/src/java/com/zimbra/cs/service/account/AutoCompleteGal.java"
        }
    },
    {
        "source": "https://github.com/zimbra/zm-mailbox/commit/d30e647f21ecef5490f21facf2e06e228b44a36e",
        "signature_version": "v1",
        "signature_type": "Line",
        "digest": {
            "line_hashes": [
                "35532726304441886843822597725517922529",
                "86869606749296562789619135716824747966",
                "329209388892522800440224682947664957145",
                "301198994465565842404478996247629867721",
                "249110717571679374632676844697594286961",
                "165150619554600532748713227738510509377",
                "135793442757343879754509969633552703576",
                "99023990949396355242231588957425096724"
            ],
            "threshold": 0.9
        },
        "deprecated": false,
        "id": "CVE-2020-10194-96c6e311",
        "target": {
            "file": "store/src/java/com/zimbra/cs/account/ldap/LdapProvisioning.java"
        }
    },
    {
        "source": "https://github.com/zimbra/zm-mailbox/commit/1df440e0efa624d1772a05fb6d397d9beb4bda1e",
        "signature_version": "v1",
        "signature_type": "Function",
        "digest": {
            "function_hash": "121930347612280065506370044909784702061",
            "length": 1002.0
        },
        "deprecated": false,
        "id": "CVE-2020-10194-aa5bbd03",
        "target": {
            "function": "handle",
            "file": "store/src/java/com/zimbra/cs/service/account/AutoCompleteGal.java"
        }
    }
]
vanir_signatures_modified 
"2026-07-08T20:30:09Z"
source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-10194.json"