CVE-2022-32294

{"id": "CVE-2022-32294", "cveTags": [{"tags": ["disputed"], "sourceIdentifier": "cve@mitre.org"}], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2022-07-11T03:15:07.810", "references": [{"url": "https://github.com/soheilsamanabadi/vulnerabilitys/blob/main/Zimbra%208.8.15%20zmprove%20ca%20command", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://github.com/soheilsamanabadi/vulnerabilitys/pull/1", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://medium.com/%40soheil.samanabadi/zimbra-8-8-15-zmprove-ca-command-incorrect-access-control-8088032638e", "source": "cve@mitre.org"}, {"url": "https://wiki.zimbra.com/wiki/Security_Center", "tags": ["Not Applicable", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories", "tags": ["Not Applicable", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://github.com/soheilsamanabadi/vulnerabilitys/blob/main/Zimbra%208.8.15%20zmprove%20ca%20command", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/soheilsamanabadi/vulnerabilitys/pull/1", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://medium.com/%40soheil.samanabadi/zimbra-8-8-15-zmprove-ca-command-incorrect-access-control-8088032638e", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://wiki.zimbra.com/wiki/Security_Center", "tags": ["Not Applicable", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories", "tags": ["Not Applicable", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "Zimbra Collaboration Open Source 8.8.15 does not encrypt the initial-login randomly created password (from the \"zmprove ca\" command). It is visible in cleartext on port UDP 514 (aka the syslog port). NOTE: a third party reports that this cannot be reproduced."}, {"lang": "es", "value": "Zimbra Collaboration Open Source versi\u00f3n 8.8.15, no cifra la contrase\u00f1a de inicio de sesi\u00f3n creada aleatoriamente (desde el comando \"zmprove ca\"). Es visible en texto sin cifrar en el puerto UDP 514 (tambi\u00e9n se conoce como el puerto syslog)"}], "lastModified": "2024-11-21T07:06:07.397", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:zimbra:collaboration:8.8.15:*:*:*:open_source:*:*:*", "vulnerable": true, "matchCriteriaId": "34A0A625-480B-479E-9BAF-C96DE9B7EE8C"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}