CVE-2020-10194

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

cs/service/account/AutoCompleteGal.java in Zimbra zm-mailbox before 8.8.15.p8 allows authenticated users to request any GAL account. This differs from the intended behavior in which the domain of the authenticated user must match the domain of the galsync account in the request.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-862

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/Zimbra/zm-mailbox/commit/1df440e0efa624d1772a05fb6d397d9beb4bda1ePatch, Third Party Advisory
https://github.com/Zimbra/zm-mailbox/compare/8.8.15.p7...8.8.15.p8Patch, Third Party Advisory
https://github.com/Zimbra/zm-mailbox/pull/1020Patch, Third Party Advisory
https://github.com/Zimbra/zm-mailbox/commit/1df440e0efa624d1772a05fb6d397d9beb4bda1ePatch, Third Party Advisory
https://github.com/Zimbra/zm-mailbox/compare/8.8.15.p7...8.8.15.p8Patch, Third Party Advisory
https://github.com/Zimbra/zm-mailbox/pull/1020Patch, Third Party Advisory

Timeline

Published: Mar 20, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-101956.3The popup-builder plugin before 3.64.1 for WordPress allows information disclosure and settings modification, leading to in-scope privilege CVE-2020-101966.1An XSS vulnerability in the popup-builder plugin before 3.64.1 for WordPress allows remote attackers to inject arbitrary JavaScript into exi CVE-2020-101998.8Sonatype Nexus Repository before 3.21.2 allows JavaEL Injection (issue 1 of 2).CVE-2020-10208.8A remote code execution vulnerability exists in Microsoft Windows when the Windows Adobe Type Manager Library improperly handles a specially CVE-2020-102034.8Sonatype Nexus Repository before 3.21.2 allows XSS.CVE-2020-102047.2Sonatype Nexus Repository before 3.21.2 allows Remote Code Execution.CVE-2020-102064.4Use of a Hard-coded Password in VNCserver in Amino Communications AK45x series, AK5xx series, AK65x series, Aria6xx series, Aria7/AK7Xx seri CVE-2020-102079.8Use of Hard-coded Credentials in EntoneWebEngine in Amino Communications AK45x series, AK5xx series, AK65x series, Aria6xx series, Aria7/AK7 CVE-2020-102089.9Command Injection in EntoneWebEngine in Amino Communications AK45x series, AK5xx series, AK65x series, Aria6xx series, Aria7/AK7Xx series an CVE-2020-102098.1Command Injection in the CPE WAN Management Protocol (CWMP) registration in Amino Communications AK45x series, AK5xx series, AK65x series, A CVE-2020-10217.8An elevation of privilege vulnerability exists in Windows Error Reporting (WER) when WER handles and executes files. The vulnerability could CVE-2020-102109.8Because of hard-coded SSH keys for the root user in Amino Communications AK45x series, AK5xx series, AK65x series, Aria6xx series, Aria7/AK7