CVE-2026-93635: falha de média gravidade em Zimbra Collaboration Suite
Zimbra Collaboration Suite LDAP Filter Injection via Unescaped computeDn() Template Substitution
Publicada em
10Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.3
probabilidade de exploração
—
exploração observada
nãonenhuma fonte reporta
LDAP filter injection in Zimbra Collaboration Suite 10.1.0 through 10.1.21 allows unauthenticated attackers to alter external LDAP search filters. On domains using search-filter authentication and lazy provisioning, this creates a password oracle for external directory users. Authenticated S/MIME lookups can also return certificates and identity data for unintended directory entries.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Produtos afetados
Zimbra · Zimbra Collaboration SuiteCVEs relacionadas — Zimbra Collaboration Suite
No mesmo produto, das mais perigosas para as menos.
CVE-2026-50055MEDIUMZimbra Collaboration Suite Sieve Notify Filter Action Bypasses Mail Forwarding Restriction via Variable ExpansionEPSS 0.3%CVE-2026-10631MEDIUMZimbra Collaboration Suite EWS Extension Authorization Bypass via Crafted Composite Folder/Item IdentifierEPSS 0.2%CVE-2026-50054HIGHZimbra Collaboration Suite GrantRightsRequest SOAP Handler Allows Self-Granting of Undocumented loginAs Mailbox Delegation RightEPSS 0.2%CVE-2026-93637LOWZimbra Collaboration Suite GraphQL Batched Authentication Bypasses Pre-Auth Rate LimitingEPSS —