CVE-2020-10194

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2020-10194

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-10194.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2020-10194

Published

2020-03-20T21:15:17Z

Modified

2026-07-08T20:30:09Z

Severity

6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N CVSS Calculator

Summary

[none]

Details

cs/service/account/AutoCompleteGal.java in Zimbra zm-mailbox before 8.8.15.p8 allows authenticated users to request any GAL account. This differs from the intended behavior in which the domain of the authenticated user must match the domain of the galsync account in the request.

References

Affected packages

Git / github.com/zimbra/zm-mailbox

Affected ranges

Type

GIT

Repo

https://github.com/zimbra/zm-mailbox

Events

Introduced

Fixed

d30e647f21ecef5490f21facf2e06e228b44a36e

Introduced

d30e647f21ecef5490f21facf2e06e228b44a36e

Last Affected

a12b964a206748de6db6dc1da2ee16249aabafce

Fixed

1df440e0efa624d1772a05fb6d397d9beb4bda1e

Database specific

Show details

{
    "cpe": [
        "cpe:2.3:a:zimbra:zm-mailbox:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:zimbra:zm-mailbox:8.8.15:-:*:*:*:*:*:*",
        "cpe:2.3:a:zimbra:zm-mailbox:8.8.15:patch1:*:*:*:*:*:*",
        "cpe:2.3:a:zimbra:zm-mailbox:8.8.15:patch2:*:*:*:*:*:*",
        "cpe:2.3:a:zimbra:zm-mailbox:8.8.15:patch3:*:*:*:*:*:*",
        "cpe:2.3:a:zimbra:zm-mailbox:8.8.15:patch4:*:*:*:*:*:*",
        "cpe:2.3:a:zimbra:zm-mailbox:8.8.15:patch5:*:*:*:*:*:*",
        "cpe:2.3:a:zimbra:zm-mailbox:8.8.15:patch6:*:*:*:*:*:*",
        "cpe:2.3:a:zimbra:zm-mailbox:8.8.15:patch7:*:*:*:*:*:*"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "8.8.15"
        },
        {
            "introduced": "8.8.15-NA"
        },
        {
            "last_affected": "8.8.15-NA"
        },
        {
            "introduced": "8.8.15-patch1"
        },
        {
            "last_affected": "8.8.15-patch1"
        },
        {
            "introduced": "8.8.15-patch2"
        },
        {
            "last_affected": "8.8.15-patch2"
        },
        {
            "introduced": "8.8.15-patch3"
        },
        {
            "last_affected": "8.8.15-patch3"
        },
        {
            "introduced": "8.8.15-patch4"
        },
        {
            "last_affected": "8.8.15-patch4"
        },
        {
            "introduced": "8.8.15-patch5"
        },
        {
            "last_affected": "8.8.15-patch5"
        },
        {
            "introduced": "8.8.15-patch6"
        },
        {
            "last_affected": "8.8.15-patch6"
        },
        {
            "introduced": "8.8.15-patch7"
        },
        {
            "last_affected": "8.8.15-patch7"
        }
    ],
    "source": [
        "CPE_RANGE",
        "CPE_STRING",
        "REFERENCES"
    ]
}

Affected versions

8.*

8.8.10

8.8.12

8.8.15

8.8.15-NA

8.8.15-patch1

8.8.15-patch2

8.8.15-patch3

8.8.15-patch4

8.8.15-patch5

8.8.15-patch6

8.8.15-patch7

8.8.15.p1

8.8.15.p2

8.8.15.p3

8.8.15.p4

8.8.15.p5

8.8.15.p6

8.8.15.p7

8.8.2

8.8.3

8.8.4

8.8.5

8.8.6

8.8.7

8.8.8

8.8.9

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-10194.json"

vanir_signatures

[
    {
        "deprecated": false,
        "digest": {
            "function_hash": "130804680382483964301386928646396783356",
            "length": 461
        },
        "id": "CVE-2020-10194-4314dc38",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/zimbra/zm-mailbox/commit/d30e647f21ecef5490f21facf2e06e228b44a36e",
        "target": {
            "file": "store/src/java/com/zimbra/cs/account/ldap/LdapProvisioning.java",
            "function": "updateLastLogon"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "229517679686205523715402217324700394259",
                "56981330284956748620401296164109700603",
                "336897459929083016848280167708331261784",
                "87588029407074370430861276684829618465",
                "103335325727630520655163700639494496382",
                "253093700081280273806403364256489052188"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2020-10194-81b4ab0b",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/zimbra/zm-mailbox/commit/1df440e0efa624d1772a05fb6d397d9beb4bda1e",
        "target": {
            "file": "store/src/java/com/zimbra/cs/service/account/AutoCompleteGal.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "35532726304441886843822597725517922529",
                "86869606749296562789619135716824747966",
                "329209388892522800440224682947664957145",
                "301198994465565842404478996247629867721",
                "249110717571679374632676844697594286961",
                "165150619554600532748713227738510509377",
                "135793442757343879754509969633552703576",
                "99023990949396355242231588957425096724"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2020-10194-96c6e311",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/zimbra/zm-mailbox/commit/d30e647f21ecef5490f21facf2e06e228b44a36e",
        "target": {
            "file": "store/src/java/com/zimbra/cs/account/ldap/LdapProvisioning.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "121930347612280065506370044909784702061",
            "length": 1002
        },
        "id": "CVE-2020-10194-aa5bbd03",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/zimbra/zm-mailbox/commit/1df440e0efa624d1772a05fb6d397d9beb4bda1e",
        "target": {
            "file": "store/src/java/com/zimbra/cs/service/account/AutoCompleteGal.java",
            "function": "handle"
        }
    }
]

vanir_signatures_modified

"2026-07-08T20:30:09Z"