CVE-2022-32294

 

Published at: - 11-07-2022 05:15

Last modified: - 13-01-2023 11:15

Total changes: - 3

Description

** DISPUTED ** Zimbra Collaboration Open Source 8.8.15 does not encrypt the initial-login randomly created password (from the "zmprove ca" command). It is visible in cleartext on port UDP 514 (aka the syslog port). NOTE: a third party reports that this cannot be reproduced.

Common Vulnerability Scoring System (CVSS)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

 

Verification logic

 

Reference

• https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories
• https://medium.com/@soheil.samanabadi/zimbra-8-8-15-zmprove-ca-command-incorrect-access-control-8088032638e
• https://github.com/soheilsamanabadi/vulnerabilitys/blob/main/Zimbra%208.8.15%20zmprove%20ca%20command
• https://wiki.zimbra.com/wiki/Security_Center
• https://github.com/soheilsamanabadi/vulnerabilitys/pull/1

 

Keywords

NVD

 

CVE-2022-32294

 

CVE

 

Common vulnerabilities & exposures

 

CVSS

 

Common vulnerability scoring system

 

Security

 

Vulnerabilities

 

Exposures