Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2020-35123: In Zimbra Collaboration Suite Network Edition versions < 9.0.0 P10 and 8.8.15 P17, there exists an XXE vulnerability in the saml consumer store extension, which is vulnerable to XXE attacks. This h...

CVE-2020-35123 · published 5 years ago

Summary

In Zimbra Collaboration Suite Network Edition versions < 9.0.0 P10 and 8.8.15 P17, there exists an XXE vulnerability in the saml consumer store extension, which is vulnerable to XXE attacks. This has been fixed in Zimbra Collaboration Suite Network edition 9.0.0 Patch 10 and 8.8.15 Patch 17.

What to do

Update zimbra collaboration to version 8.8.15 or later.

Affected software

Vendor	Product	Affected versions
zimbra	collaboration	> 8.8.0, < 8.8.15 8.8.15 9.0.0 `cpe:2.3:a:zimbra:collaboration::::::::`

Original advisory text

References

https://wiki.zimbra.com/wiki/Security_Center Product
https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.15/P17 Release Notes Vendor Advisory
https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P10 Third Party Advisory Vendor Advisory
https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories Vendor Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker partial control (estimated)

Severity

6.5 Medium

Exploitation

2% chance of attack within 30 days

Type

CWE-611XML External Entity (XXE)

Timeline

Published17 Dec 2020

Updated31 Oct 2026

First seen29 Sep 2026

Sources

CVE-2020-35123 · NVD

Track software like this

Free during beta