CVE-2020-35123

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2020-35123
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-35123.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2020-35123
Published
2020-12-17T04:15:12.840Z
Modified
2026-07-08T05:56:41.813662507Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
[none]
Details

In Zimbra Collaboration Suite Network Edition versions < 9.0.0 P10 and 8.8.15 P17, there exists an XXE vulnerability in the saml consumer store extension, which is vulnerable to XXE attacks. This has been fixed in Zimbra Collaboration Suite Network edition 9.0.0 Patch 10 and 8.8.15 Patch 17.

Database specific 
{
    "unresolved_ranges": [
        {
            "cpes": [
                "cpe:2.3:a:zimbra:collaboration:8.8.15:p10:*:*:*:*:*:*",
                "cpe:2.3:a:zimbra:collaboration:8.8.15:p12:*:*:*:*:*:*",
                "cpe:2.3:a:zimbra:collaboration:8.8.15:p13:*:*:*:*:*:*",
                "cpe:2.3:a:zimbra:collaboration:8.8.15:p14:*:*:*:*:*:*",
                "cpe:2.3:a:zimbra:collaboration:8.8.15:p15:*:*:*:*:*:*",
                "cpe:2.3:a:zimbra:collaboration:8.8.15:p16:*:*:*:*:*:*",
                "cpe:2.3:a:zimbra:collaboration:8.8.15:p2:*:*:*:*:*:*",
                "cpe:2.3:a:zimbra:collaboration:8.8.15:p4:*:*:*:*:*:*",
                "cpe:2.3:a:zimbra:collaboration:8.8.15:p6:*:*:*:*:*:*",
                "cpe:2.3:a:zimbra:collaboration:8.8.15:p7:*:*:*:*:*:*",
                "cpe:2.3:a:zimbra:collaboration:8.8.15:p8:*:*:*:*:*:*",
                "cpe:2.3:a:zimbra:collaboration:8.8.15:p9:*:*:*:*:*:*",
                "cpe:2.3:a:zimbra:collaboration:9.0.0:p2:*:*:*:*:*:*",
                "cpe:2.3:a:zimbra:collaboration:9.0.0:p3:*:*:*:*:*:*",
                "cpe:2.3:a:zimbra:collaboration:9.0.0:p5:*:*:*:*:*:*",
                "cpe:2.3:a:zimbra:collaboration:9.0.0:p6:*:*:*:*:*:*",
                "cpe:2.3:a:zimbra:collaboration:9.0.0:p8:*:*:*:*:*:*",
                "cpe:2.3:a:zimbra:collaboration:9.0.0:p9:*:*:*:*:*:*"
            ],
            "extracted_events": [
                {
                    "introduced": "8.8.15-p10"
                },
                {
                    "last_affected": "8.8.15-p10"
                },
                {
                    "introduced": "8.8.15-p12"
                },
                {
                    "last_affected": "8.8.15-p12"
                },
                {
                    "introduced": "8.8.15-p13"
                },
                {
                    "last_affected": "8.8.15-p13"
                },
                {
                    "introduced": "8.8.15-p14"
                },
                {
                    "last_affected": "8.8.15-p14"
                },
                {
                    "introduced": "8.8.15-p15"
                },
                {
                    "last_affected": "8.8.15-p15"
                },
                {
                    "introduced": "8.8.15-p16"
                },
                {
                    "last_affected": "8.8.15-p16"
                },
                {
                    "introduced": "8.8.15-p2"
                },
                {
                    "last_affected": "8.8.15-p2"
                },
                {
                    "introduced": "8.8.15-p4"
                },
                {
                    "last_affected": "8.8.15-p4"
                },
                {
                    "introduced": "8.8.15-p6"
                },
                {
                    "last_affected": "8.8.15-p6"
                },
                {
                    "introduced": "8.8.15-p7"
                },
                {
                    "last_affected": "8.8.15-p7"
                },
                {
                    "introduced": "8.8.15-p8"
                },
                {
                    "last_affected": "8.8.15-p8"
                },
                {
                    "introduced": "8.8.15-p9"
                },
                {
                    "last_affected": "8.8.15-p9"
                },
                {
                    "introduced": "9.0.0-p2"
                },
                {
                    "last_affected": "9.0.0-p2"
                },
                {
                    "introduced": "9.0.0-p3"
                },
                {
                    "last_affected": "9.0.0-p3"
                },
                {
                    "introduced": "9.0.0-p5"
                },
                {
                    "last_affected": "9.0.0-p5"
                },
                {
                    "introduced": "9.0.0-p6"
                },
                {
                    "last_affected": "9.0.0-p6"
                },
                {
                    "introduced": "9.0.0-p8"
                },
                {
                    "last_affected": "9.0.0-p8"
                },
                {
                    "introduced": "9.0.0-p9"
                },
                {
                    "last_affected": "9.0.0-p9"
                }
            ],
            "vendor_product": "zimbra:collaboration",
            "source": "CPE_STRING"
        }
    ]
}
References

Affected packages

Git / github.com/zimbra/zm-build

Affected ranges

Type
GIT
Repo
https://github.com/zimbra/zm-build
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
ac6081fa002b1511e926aba37740d2b6c20f3f43
Introduced
ac6081fa002b1511e926aba37740d2b6c20f3f43
Last affected
bcb978ccc354d99d843725886083e321759b6765
Database specific 
{
    "cpe": [
        "cpe:2.3:a:zimbra:collaboration:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:zimbra:collaboration:8.8.15:-:*:*:*:*:*:*",
        "cpe:2.3:a:zimbra:collaboration:8.8.15:p1:*:*:*:*:*:*",
        "cpe:2.3:a:zimbra:collaboration:8.8.15:p11:*:*:*:*:*:*",
        "cpe:2.3:a:zimbra:collaboration:8.8.15:p3:*:*:*:*:*:*",
        "cpe:2.3:a:zimbra:collaboration:8.8.15:p5:*:*:*:*:*:*",
        "cpe:2.3:a:zimbra:collaboration:9.0.0:-:*:*:*:*:*:*",
        "cpe:2.3:a:zimbra:collaboration:9.0.0:p1:*:*:*:*:*:*",
        "cpe:2.3:a:zimbra:collaboration:9.0.0:p4:*:*:*:*:*:*",
        "cpe:2.3:a:zimbra:collaboration:9.0.0:p7:*:*:*:*:*:*"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "8.8.15"
        },
        {
            "introduced": "8.8.15-NA"
        },
        {
            "last_affected": "8.8.15-NA"
        },
        {
            "introduced": "8.8.15-p1"
        },
        {
            "last_affected": "8.8.15-p1"
        },
        {
            "introduced": "8.8.15-p11"
        },
        {
            "last_affected": "8.8.15-p11"
        },
        {
            "introduced": "8.8.15-p3"
        },
        {
            "last_affected": "8.8.15-p3"
        },
        {
            "introduced": "8.8.15-p5"
        },
        {
            "last_affected": "8.8.15-p5"
        },
        {
            "introduced": "9.0.0-NA"
        },
        {
            "last_affected": "9.0.0-NA"
        },
        {
            "introduced": "9.0.0-p1"
        },
        {
            "last_affected": "9.0.0-p1"
        },
        {
            "introduced": "9.0.0-p4"
        },
        {
            "last_affected": "9.0.0-p4"
        },
        {
            "introduced": "9.0.0-p7"
        },
        {
            "last_affected": "9.0.0-p7"
        }
    ],
    "source": [
        "CPE_RANGE",
        "CPE_STRING"
    ]
}

Affected versions

8.*
8.7.10
8.7.11
8.7.6
8.7.7
8.7.9
8.8.0.beta1
8.8.10
8.8.12
8.8.15-NA
8.8.15-p1
8.8.15-p3
8.8.15-p5
8.8.2
8.8.3
8.8.4
8.8.6
8.8.7
8.8.8
8.8.9
8.8.9.p1
8.8.9.p3
9.*
9.0.0
9.0.0-NA
9.0.0-p1
9.0.0-p4
9.0.0-p7
9.0.0.p4
9.0.0.p7

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-35123.json"