CVE-2023-41106
HIGH
7.5
CVSS Score
Published: December 7, 2023 at 12:00 AM UTC
Updated: June 17, 2026 at 06:20 AM UTC
1 product affected across 1 vendorCollaboration
Using N/A by N/A?
Get instant alerts when new vulnerabilities affect N/A - before attackers find them.
Real-time alertsTrack your software stackFree plan available
Severity
HIGH7.5
Exploit prediction
EPSS 1%
Description
An issue was discovered in Zimbra Collaboration (ZCS) before 10.0.3. An attacker can gain access to a Zimbra account. This is also fixed in 9.0.0 Patch 35 and 8.8.15 Patch 42.
Affected
Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.
v < 8.8.1510.0.0 ≤ v < 10.0.38.8.158.8.15 p18.8.15 p108.8.15 p118.8.15 p128.8.15 p138.8.15 p148.8.15 p158.8.15 p168.8.15 p178.8.15 p188.8.15 p198.8.15 p28.8.15 p208.8.15 p218.8.15 p228.8.15 p238.8.15 p248.8.15 p258.8.15 p268.8.15 p278.8.15 p288.8.15 p298.8.15 p38.8.15 p308.8.15 p318.8.15 p328.8.15 p338.8.15 p348.8.15 p358.8.15 p378.8.15 p48.8.15 p408.8.15 p418.8.15 p58.8.15 p68.8.15 p78.8.15 p88.8.15 p99.0.09.0.0 p09.0.0 p19.0.0 p109.0.0 p119.0.0 p129.0.0 p139.0.0 p149.0.0 p159.0.0 p169.0.0 p199.0.0 p29.0.0 p209.0.0 p219.0.0 p239.0.0 p249.0.0 p24.19.0.0 p259.0.0 p269.0.0 p279.0.0 p39.0.0 p339.0.0 p349.0.0 p49.0.0 p59.0.0 p69.0.0 p79.0.0 p7.19.0.0 p89.0.0 p9
Affected range stops below 10.0.3, so it looks safe — our inference, not a vendor statement
Affected range stops below 8.8.15, so it looks safe — our inference, not a vendor statement
Remediation
No guide yetNo remediation guidance has been written for this CVE yet. What the record does show:
Patch and advisory references
References (3)
Mailing ListThird Party Advisory
Source: [email protected]
http://www.openwall.com/lists/oss-security/2023/11/17/2CVSS
- Attack Vector
- NETWORK
- Complexity
- LOW
- Privileges
- NONE
- User Interaction
- NONE
- Scope
- UNCHANGED
- Confidentiality
- HIGH
- Integrity
- NONE
- Availability
- NONE
Vector?
Quick Info
StatusMODIFIED
CWE
NVD-CWE-noinfo
Get alerted
Stop reading CVE feeds looking for your own stack
Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.
Free plan, no card