AI analysis
Zimbra Collaboration Suite 10.1.0 through 10.1.21 has an LDAP filter injection flaw (CWE-90) that lets an unauthenticated attacker change external LDAP search filters. On domains that authenticate with a search filter and use lazy provisioning, that change can turn directory lookups into a password oracle for external directory users. Authenticated S/MIME lookups can also return certificates and identity data for directory entries the caller was not meant to see. The issue is network-reachable with no privileges or user interaction; CVSS 3.1 rates it 5.3 (medium) with low confidentiality impact. It is not listed in CISA KEV, and no public proof-of-concept or in-the-wild exploitation is known.
What to do: Upgrade Zimbra Collaboration Suite to a release newer than 10.1.21 as soon as the vendor publishes a fix, and confirm the installed build is outside 10.1.0–10.1.21. Until then, review domains that use external LDAP search-filter authentication and lazy provisioning, restrict or disable that auth path if it is not required, and watch authentication and S/MIME certificate lookups for unexpected directory matches.
Affected
| Zimbra Collaboration Suite | 10.1.0 through 10.1.21 |
Estimated exposure
moderatelow tens of thousands of Zimbra servers possibly on 10.1.x; a smaller subset meet the LDAP auth conditions — Zimbra is a widely deployed mail and collaboration platform with on the order of tens of thousands of internet-reachable servers in historical public scans; only the 10.1.0–10.1.21 line is in scope, and the password-oracle impact further…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
LDAP filter injection in Zimbra Collaboration Suite 10.1.0 through 10.1.21 allows unauthenticated attackers to alter external LDAP search filters. On domains using search-filter authentication and lazy provisioning, this creates a password oracle for external directory users. Authenticated S/MIME lookups can also return certificates and identity data for unintended directory entries.