AI analysis
Zimbra Collaboration Suite 10.1.0 through 10.1.21 has an authentication rate-limit bypass (CWE-307) in its GraphQL interface. An unauthenticated remote attacker can pack repeated password guesses into one HTTP request using GraphQL aliases, and those attempts do not increment Zimbra’s source-IP authentication failure counter. A successful guess could reveal account credentials (confidentiality only; CVSS 3.1 base score 3.7, with high attack complexity and no integrity or availability impact). Organizations running those 10.1 releases, including internet-facing webmail, are affected. No public proof of concept is known, and the issue is not in CISA’s Known Exploited Vulnerabilities catalog.
What to do: Move Zimbra Collaboration Suite off the 10.1.0–10.1.21 range as soon as the vendor publishes a fixed build; the advisory data does not name a patched version. Until then, rate-limit or block multi-alias GraphQL authentication requests at a reverse proxy or WAF, and review auth logs for password-guessing bursts that never incremented the source-IP failure counter.
Affected
| Zimbra Collaboration Suite | 10.1.0 through 10.1.21 |
Estimated exposure
moderateroughly 1,000–10,000 internet-facing servers on 10.1.0–10.1.21 (estimate) — Public scans have long shown on the order of tens of thousands of internet-facing Zimbra hosts overall; only the 10.1.0–10.1.21 range is affected, so the exposed subset is plausibly in the low thousands rather than the full install base.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
An authentication rate-limit bypass in Zimbra Collaboration Suite 10.1.0 through 10.1.21 allows unauthenticated attackers to make repeated password guesses through GraphQL without incrementing Zimbra’s source-IP failure counter. GraphQL aliases allow multiple authentication attempts in one HTTP request.