{"id":"CVE-2018-15131","aliases":["EUVD-2018-7012","GHSA-93m3-4vp5-23qr"],"status":"published","title":"An issue was discovered in Synacor Zimbra Collaboration Suite 8.6.x before 8.6.0 Patch 11, 8.7.x...","description":"An issue was discovered in Synacor Zimbra Collaboration Suite 8.6.x before 8.6.0 Patch 11, 8.7.x before 8.7.11 Patch 6, 8.8.x before 8.8.8 Patch 9, and 8.8.9 before 8.8.9 Patch 3. Account number enumeration is possible via inconsistent responses for specific types of authentication requests.","severity":{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.01878,"percentile":0.79574,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-200"],"published":"2019-05-30T15:22:03Z","modified":"2026-10-24T10:30:38Z","exploits":[{"source":"pocgithub","id":"0x00-0x00/CVE-2018-15131","title":"0x00-0x00/CVE-2018-15131","date":"2018-09-05","url":"https://github.com/0x00-0x00/CVE-2018-15131"}],"products":[{"vendor":"synacor","product":"zimbra_collaboration_suite"}],"references":[{"url":"https://bugzilla.zimbra.com/show_bug.cgi?id=109012","tags":["x_refsource_MISC","x_transferred","Exploit","Issue Tracking","Third Party Advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-15131"},{"url":"https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories","tags":["Vendor Advisory","advisory"]},{"url":"https://github.com/advisories/GHSA-93m3-4vp5-23qr"}],"sources":{"cve":[{"id":"CVE-2018-15131","description":"An issue was discovered in Synacor Zimbra Collaboration Suite 8.6.x before 8.6.0 Patch 11, 8.7.x before 8.7.11 Patch 6, 8.8.x before 8.8.8 Patch 9, and 8.8.9 before 8.8.9 Patch 3. Account number enumeration is possible via inconsistent responses for specific types of authentication requests.","status":"published","published":"2019-05-30T15:22:03Z","modified":"2024-08-05T09:46:25.307Z","updated_at":"2026-11-02T14:35:03.825765Z"}],"euvd":[{"id":"EUVD-2018-7012","description":"An issue was discovered in Synacor Zimbra Collaboration Suite 8.6.x before 8.6.0 Patch 11, 8.7.x before 8.7.11 Patch 6, 8.8.x before 8.8.8 Patch 9, and 8.8.9 before 8.8.9 Patch 3. Account number enumeration is possible via inconsistent responses for specific types of authentication requests.","status":"published","published":"2019-05-30T15:22:03Z","modified":"2024-08-05T09:46:25Z","updated_at":"2026-11-03T02:39:45.27774Z"}],"ghsa":[{"id":"GHSA-93m3-4vp5-23qr","title":"An issue was discovered in Synacor Zimbra Collaboration Suite 8.6.x before 8.6.0 Patch 11, 8.7.x...","description":"An issue was discovered in Synacor Zimbra Collaboration Suite 8.6.x before 8.6.0 Patch 11, 8.7.x before 8.7.11 Patch 6, 8.8.x before 8.8.8 Patch 9, and 8.8.9 before 8.8.9 Patch 3. Account number enumeration is possible via inconsistent responses for specific types of authentication requests.","status":"published","published":"2022-05-24T22:00:01Z","modified":"2023-01-30T05:03:55Z","updated_at":"2026-11-02T14:46:56.128795Z"}],"nvd":[{"id":"CVE-2018-15131","description":"An issue was discovered in Synacor Zimbra Collaboration Suite 8.6.x before 8.6.0 Patch 11, 8.7.x before 8.7.11 Patch 6, 8.8.x before 8.8.8 Patch 9, and 8.8.9 before 8.8.9 Patch 3. Account number enumeration is possible via inconsistent responses for specific types of authentication requests.","status":"published","published":"2019-05-30T16:29:00.98Z","modified":"2026-06-17T01:42:06.12Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:04:57.307075Z"}],"osv":[{"id":"CVE-2018-15131","description":"An issue was discovered in Synacor Zimbra Collaboration Suite 8.6.x before 8.6.0 Patch 11, 8.7.x before 8.7.11 Patch 6, 8.8.x before 8.8.8 Patch 9, and 8.8.9 before 8.8.9 Patch 3. Account number enumeration is possible via inconsistent responses for specific types of authentication requests.","status":"published","published":"2019-05-30T16:29:00.98Z","modified":"2026-10-24T10:30:38.506594868Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:08.242347Z"}]}}