{"id":"CVE-2018-15131","details":"An issue was discovered in Synacor Zimbra Collaboration Suite 8.6.x before 8.6.0 Patch 11, 8.7.x before 8.7.11 Patch 6, 8.8.x before 8.8.8 Patch 9, and 8.8.9 before 8.8.9 Patch 3. Account number enumeration is possible via inconsistent responses for specific types of authentication requests.","modified":"2026-09-14T03:45:15.116599001Z","published":"2019-05-30T16:29:00.980Z","database_specific":{"unresolved_ranges":[{"extracted_events":[{"introduced":"8.6.0-NA"},{"last_affected":"8.6.0-NA"},{"introduced":"8.6.0-NA"},{"last_affected":"8.6.0-NA"},{"introduced":"8.6.0-NA"},{"last_affected":"8.6.0-NA"},{"introduced":"8.6.0-NA"},{"last_affected":"8.6.0-NA"},{"introduced":"8.6.0-p1"},{"last_affected":"8.6.0-p1"},{"introduced":"8.6.0-p1"},{"last_affected":"8.6.0-p1"},{"introduced":"8.6.0-p1"},{"last_affected":"8.6.0-p1"},{"introduced":"8.6.0-p1"},{"last_affected":"8.6.0-p1"},{"introduced":"8.6.0-p10"},{"last_affected":"8.6.0-p10"},{"introduced":"8.6.0-p10"},{"last_affected":"8.6.0-p10"},{"introduced":"8.6.0-p10"},{"last_affected":"8.6.0-p10"},{"introduced":"8.6.0-p10"},{"last_affected":"8.6.0-p10"},{"introduced":"8.6.0-p2"},{"last_affected":"8.6.0-p2"},{"introduced":"8.6.0-p2"},{"last_affected":"8.6.0-p2"},{"introduced":"8.6.0-p2"},{"last_affected":"8.6.0-p2"},{"introduced":"8.6.0-p2"},{"last_affected":"8.6.0-p2"},{"introduced":"8.6.0-p3"},{"last_affected":"8.6.0-p3"},{"introduced":"8.6.0-p3"},{"last_affected":"8.6.0-p3"},{"introduced":"8.6.0-p3"},{"last_affected":"8.6.0-p3"},{"introduced":"8.6.0-p3"},{"last_affected":"8.6.0-p3"},{"introduced":"8.6.0-p4"},{"last_affected":"8.6.0-p4"},{"introduced":"8.6.0-p4"},{"last_affected":"8.6.0-p4"},{"introduced":"8.6.0-p4"},{"last_affected":"8.6.0-p4"},{"introduced":"8.6.0-p4"},{"last_affected":"8.6.0-p4"},{"introduced":"8.6.0-p5"},{"last_affected":"8.6.0-p5"},{"introduced":"8.6.0-p5"},{"last_affected":"8.6.0-p5"},{"introduced":"8.6.0-p5"},{"last_affected":"8.6.0-p5"},{"introduced":"8.6.0-p5"},{"last_affected":"8.6.0-p5"},{"introduced":"8.6.0-p6"},{"last_affected":"8.6.0-p6"},{"introduced":"8.6.0-p6"},{"last_affected":"8.6.0-p6"},{"introduced":"8.6.0-p6"},{"last_affected":"8.6.0-p6"},{"introduced":"8.6.0-p6"},{"last_affected":"8.6.0-p6"},{"introduced":"8.6.0-p8"},{"last_affected":"8.6.0-p8"},{"introduced":"8.6.0-p8"},{"last_affected":"8.6.0-p8"},{"introduced":"8.6.0-p8"},{"last_affected":"8.6.0-p8"},{"introduced":"8.6.0-p8"},{"last_affected":"8.6.0-p8"},{"introduced":"8.6.0-p9"},{"last_affected":"8.6.0-p9"},{"introduced":"8.6.0-p9"},{"last_affected":"8.6.0-p9"},{"introduced":"8.6.0-p9"},{"last_affected":"8.6.0-p9"},{"introduced":"8.6.0-p9"},{"last_affected":"8.6.0-p9"},{"introduced":"8.8.8-p2"},{"last_affected":"8.8.8-p2"},{"introduced":"8.8.8-p2"},{"last_affected":"8.8.8-p2"},{"introduced":"8.8.8-p2"},{"last_affected":"8.8.8-p2"},{"introduced":"8.8.8-p2"},{"last_affected":"8.8.8-p2"},{"introduced":"8.8.8-p5"},{"last_affected":"8.8.8-p5"},{"introduced":"8.8.8-p5"},{"last_affected":"8.8.8-p5"},{"introduced":"8.8.8-p5"},{"last_affected":"8.8.8-p5"},{"introduced":"8.8.8-p5"},{"last_affected":"8.8.8-p5"}],"source":"CPE_STRING","vendor_product":"synacor:zimbra_collaboration_suite","cpes":["cpe:2.3:a:synacor:zimbra_collaboration_suite:8.6.0:-:*:*:*:*:*:*","cpe:2.3:a:synacor:zimbra_collaboration_suite:8.6.0:p10:*:*:*:*:*:*","cpe:2.3:a:synacor:zimbra_collaboration_suite:8.6.0:p1:*:*:*:*:*:*","cpe:2.3:a:synacor:zimbra_collaboration_suite:8.6.0:p2:*:*:*:*:*:*","cpe:2.3:a:synacor:zimbra_collaboration_suite:8.6.0:p3:*:*:*:*:*:*","cpe:2.3:a:synacor:zimbra_collaboration_suite:8.6.0:p4:*:*:*:*:*:*","cpe:2.3:a:synacor:zimbra_collaboration_suite:8.6.0:p5:*:*:*:*:*:*","cpe:2.3:a:synacor:zimbra_collaboration_suite:8.6.0:p6:*:*:*:*:*:*","cpe:2.3:a:synacor:zimbra_collaboration_suite:8.6.0:p8:*:*:*:*:*:*","cpe:2.3:a:synacor:zimbra_collaboration_suite:8.6.0:p9:*:*:*:*:*:*","cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.8:p2:*:*:*:*:*:*","cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.8:p5:*:*:*:*:*:*"]}]},"references":[{"type":"ADVISORY","url":"https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories"},{"type":"REPORT","url":"https://bugzilla.zimbra.com/show_bug.cgi?id=109012"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/zimbra/zm-build","events":[{"introduced":"0"},{"fixed":"6c3c77b328a0d7d3bafecb79d202960217922ef0"},{"fixed":"a12f6b5f02776dff1d0554a7998ae6c6ee0dd820"},{"introduced":"6c3c77b328a0d7d3bafecb79d202960217922ef0"},{"last_affected":"5000d7ff7c8650dbfff91678647fabc2bbf0e64b"}],"database_specific":{"source":["CPE_RANGE","CPE_STRING"],"cpe":["cpe:2.3:a:synacor:zimbra_collaboration_suite:*:*:*:*:*:*:*:*","cpe:2.3:a:synacor:zimbra_collaboration_suite:8.7.11:-:*:*:*:*:*:*","cpe:2.3:a:synacor:zimbra_collaboration_suite:8.7.11:p1:*:*:*:*:*:*","cpe:2.3:a:synacor:zimbra_collaboration_suite:8.7.11:p2:*:*:*:*:*:*","cpe:2.3:a:synacor:zimbra_collaboration_suite:8.7.11:p3:*:*:*:*:*:*","cpe:2.3:a:synacor:zimbra_collaboration_suite:8.7.11:p4:*:*:*:*:*:*","cpe:2.3:a:synacor:zimbra_collaboration_suite:8.7.11:p5:*:*:*:*:*:*","cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.8:-:*:*:*:*:*:*","cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.8:p1:*:*:*:*:*:*","cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.8:p3:*:*:*:*:*:*","cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.8:p4:*:*:*:*:*:*","cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.8:p7:*:*:*:*:*:*","cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.9:-:*:*:*:*:*:*","cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.9:p1:*:*:*:*:*:*"],"extracted_events":[{"introduced":"8.7.0"},{"fixed":"8.7.11"},{"introduced":"8.8.0"},{"fixed":"8.8.8"},{"introduced":"8.7.11-NA"},{"last_affected":"8.7.11-NA"},{"introduced":"8.7.11-p1"},{"last_affected":"8.7.11-p1"},{"introduced":"8.7.11-p2"},{"last_affected":"8.7.11-p2"},{"introduced":"8.7.11-p3"},{"last_affected":"8.7.11-p3"},{"introduced":"8.7.11-p4"},{"last_affected":"8.7.11-p4"},{"introduced":"8.7.11-p5"},{"last_affected":"8.7.11-p5"},{"introduced":"8.8.8-NA"},{"last_affected":"8.8.8-NA"},{"introduced":"8.8.8-p1"},{"last_affected":"8.8.8-p1"},{"introduced":"8.8.8-p3"},{"last_affected":"8.8.8-p3"},{"introduced":"8.8.8-p4"},{"last_affected":"8.8.8-p4"},{"introduced":"8.8.8-p7"},{"last_affected":"8.8.8-p7"},{"introduced":"8.8.9-NA"},{"last_affected":"8.8.9-NA"},{"introduced":"8.8.9-p1"},{"last_affected":"8.8.9-p1"}]}}],"versions":["8.7.11-NA","8.7.11-p1","8.7.11-p2","8.7.11-p3","8.7.11-p4","8.7.11-p5","8.8.8-NA","8.8.8-p1","8.8.9-NA","8.8.9.p3","8.8.9.p1","8.8.9","8.8.8","8.7.11","8.8.7","8.8.6","8.8.4","8.8.3","8.8.2","8.8.0.beta1","8.7.10","8.7.9","8.7.7","8.7.6"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-15131.json"}},{"ranges":[{"type":"GIT","repo":"https://github.com/zimbra/zm-mailbox","events":[{"introduced":"0"},{"fixed":"65929222951131db2cbb2378accbdd5f2fac0980"},{"fixed":"49778e9798e139cb059be07aa1810a2d624ef888"},{"introduced":"65929222951131db2cbb2378accbdd5f2fac0980"},{"last_affected":"d3c6ef3616ff8d06555806b60d3a4aa5a3ab6d92"}],"database_specific":{"cpe":["cpe:2.3:a:synacor:zimbra_collaboration_suite:*:*:*:*:*:*:*:*","cpe:2.3:a:synacor:zimbra_collaboration_suite:8.7.11:-:*:*:*:*:*:*","cpe:2.3:a:synacor:zimbra_collaboration_suite:8.7.11:p1:*:*:*:*:*:*","cpe:2.3:a:synacor:zimbra_collaboration_suite:8.7.11:p2:*:*:*:*:*:*","cpe:2.3:a:synacor:zimbra_collaboration_suite:8.7.11:p3:*:*:*:*:*:*","cpe:2.3:a:synacor:zimbra_collaboration_suite:8.7.11:p4:*:*:*:*:*:*","cpe:2.3:a:synacor:zimbra_collaboration_suite:8.7.11:p5:*:*:*:*:*:*","cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.8:-:*:*:*:*:*:*","cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.8:p1:*:*:*:*:*:*","cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.8:p3:*:*:*:*:*:*","cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.8:p4:*:*:*:*:*:*","cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.8:p6:*:*:*:*:*:*","cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.8:p7:*:*:*:*:*:*","cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.9:-:*:*:*:*:*:*","cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.9:p1:*:*:*:*:*:*","cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.9:p2:*:*:*:*:*:*"],"extracted_events":[{"introduced":"8.7.0"},{"fixed":"8.7.11"},{"introduced":"8.8.0"},{"fixed":"8.8.8"},{"introduced":"8.7.11-NA"},{"last_affected":"8.7.11-NA"},{"introduced":"8.7.11-p1"},{"last_affected":"8.7.11-p1"},{"introduced":"8.7.11-p2"},{"last_affected":"8.7.11-p2"},{"introduced":"8.7.11-p3"},{"last_affected":"8.7.11-p3"},{"introduced":"8.7.11-p4"},{"last_affected":"8.7.11-p4"},{"introduced":"8.7.11-p5"},{"last_affected":"8.7.11-p5"},{"introduced":"8.8.8-NA"},{"last_affected":"8.8.8-NA"},{"introduced":"8.8.8-p1"},{"last_affected":"8.8.8-p1"},{"introduced":"8.8.8-p3"},{"last_affected":"8.8.8-p3"},{"introduced":"8.8.8-p4"},{"last_affected":"8.8.8-p4"},{"introduced":"8.8.8-p6"},{"last_affected":"8.8.8-p6"},{"introduced":"8.8.8-p7"},{"last_affected":"8.8.8-p7"},{"introduced":"8.8.9-NA"},{"last_affected":"8.8.9-NA"},{"introduced":"8.8.9-p1"},{"last_affected":"8.8.9-p1"},{"introduced":"8.8.9-p2"},{"last_affected":"8.8.9-p2"}],"source":["CPE_RANGE","CPE_STRING"]}}],"versions":["8.7.11-NA","8.7.11-p1","8.7.11-p2","8.7.11-p3","8.7.11-p4","8.7.11-p5","8.8.8-NA","8.8.8-p1","8.8.8-p3","8.8.8-p4","8.8.8-p6","8.8.8-p7","8.8.9-NA","8.8.9-p1","8.8.9-p2","8.8.8","8.7.6","8.8.9","8.8.9.p2","8.8.9.p1","8.8.7","8.8.6","8.8.5","8.8.4","8.8.3","8.8.2","8.7.10","8.7.9","8.7.7"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-15131.json"}},{"ranges":[{"type":"GIT","repo":"https://github.com/zimbra/zm-zcs","events":[{"introduced":"0"},{"fixed":"e177bad87d5312e7b2cd1915ae8c0cd2528cacdb"},{"fixed":"34aff8ccf0b1b56d129015c54153bf823915f8ce"},{"introduced":"e177bad87d5312e7b2cd1915ae8c0cd2528cacdb"},{"last_affected":"d36a4c8999c6377b7ae36c22f47bbea75974e8cc"}],"database_specific":{"source":["CPE_RANGE","CPE_STRING"],"cpe":["cpe:2.3:a:synacor:zimbra_collaboration_suite:*:*:*:*:*:*:*:*","cpe:2.3:a:synacor:zimbra_collaboration_suite:8.7.11:-:*:*:*:*:*:*","cpe:2.3:a:synacor:zimbra_collaboration_suite:8.7.11:p1:*:*:*:*:*:*","cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.8:-:*:*:*:*:*:*","cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.9:-:*:*:*:*:*:*"],"extracted_events":[{"introduced":"8.7.0"},{"fixed":"8.7.11"},{"introduced":"8.8.0"},{"fixed":"8.8.8"},{"introduced":"8.7.11-NA"},{"last_affected":"8.7.11-NA"},{"introduced":"8.7.11-p1"},{"last_affected":"8.7.11-p1"},{"introduced":"8.8.8-NA"},{"last_affected":"8.8.8-NA"},{"introduced":"8.8.9-NA"},{"last_affected":"8.8.9-NA"}]}}],"versions":["8.7.11-NA","8.7.11-p1","8.8.8-NA","8.8.9-NA","8.8.9","8.8.8","8.7.11","8.8.7","8.8.6","8.8.5","8.8.4","8.8.3","8.8.2","8.8.0beta2","8.8.0.beta1","8.7.10","8.7.9","8.7.7","8.7.6"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-15131.json"}},{"ranges":[{"type":"GIT","repo":"https://github.com/zimbra/zm-zcs-lib","events":[{"introduced":"0"},{"fixed":"a1cbf80618e47b3cf0894cbbcaec1da9bece583c"},{"fixed":"048ff3fb24f199ee7081e4f1504ec965cdc98be6"},{"introduced":"a1cbf80618e47b3cf0894cbbcaec1da9bece583c"},{"last_affected":"6e5ea502a8b78a16e1c2d1d51331b62c31eb4c7e"}],"database_specific":{"cpe":["cpe:2.3:a:synacor:zimbra_collaboration_suite:*:*:*:*:*:*:*:*","cpe:2.3:a:synacor:zimbra_collaboration_suite:8.7.11:-:*:*:*:*:*:*","cpe:2.3:a:synacor:zimbra_collaboration_suite:8.7.11:p3:*:*:*:*:*:*","cpe:2.3:a:synacor:zimbra_collaboration_suite:8.7.11:p4:*:*:*:*:*:*","cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.8:-:*:*:*:*:*:*","cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.9:-:*:*:*:*:*:*"],"extracted_events":[{"introduced":"8.7.0"},{"fixed":"8.7.11"},{"introduced":"8.8.0"},{"fixed":"8.8.8"},{"introduced":"8.7.11-NA"},{"last_affected":"8.7.11-NA"},{"introduced":"8.7.11-p3"},{"last_affected":"8.7.11-p3"},{"introduced":"8.7.11-p4"},{"last_affected":"8.7.11-p4"},{"introduced":"8.8.8-NA"},{"last_affected":"8.8.8-NA"},{"introduced":"8.8.9-NA"},{"last_affected":"8.8.9-NA"}],"source":["CPE_RANGE","CPE_STRING"]}}],"versions":["8.7.11-NA","8.7.11-p3","8.8.8-NA","8.8.9-NA","8.8.9","8.8.8","8.7.11","8.8.7","8.8.6","8.8.5","8.8.4","8.8.3","8.8.2","8.8.0.beta1","8.7.10","8.7.9","8.7.7","8.7.6"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-15131.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}]}