mailboxd in Zimbra Collaboration Suite 8.8 before 8.8.8; 8.7 before 8.7.11.Patch3; and 8.6 before 8.6.0.Patch10 allows zimbraSSLPrivateKey read access via a GetServer, GetAllServers, or GetAllActiveServers call in the Admin SOAP API.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Zimbra_collaboration_suite | Synacor | 8.7.0 (including) | 8.7.11 (including) |
| Zimbra_collaboration_suite | Synacor | 8.8.0 (including) | 8.8.8 (excluding) |
| Zimbra_collaboration_suite | Synacor | 8.6.0 (including) | 8.6.0 (including) |
| Zimbra_collaboration_suite | Synacor | 8.6.0-patch1 (including) | 8.6.0-patch1 (including) |
| Zimbra_collaboration_suite | Synacor | 8.6.0-patch2 (including) | 8.6.0-patch2 (including) |
| Zimbra_collaboration_suite | Synacor | 8.6.0-patch3 (including) | 8.6.0-patch3 (including) |
| Zimbra_collaboration_suite | Synacor | 8.6.0-patch4 (including) | 8.6.0-patch4 (including) |
| Zimbra_collaboration_suite | Synacor | 8.6.0-patch5 (including) | 8.6.0-patch5 (including) |
| Zimbra_collaboration_suite | Synacor | 8.6.0-patch6 (including) | 8.6.0-patch6 (including) |
| Zimbra_collaboration_suite | Synacor | 8.6.0-patch7 (including) | 8.6.0-patch7 (including) |
| Zimbra_collaboration_suite | Synacor | 8.6.0-patch8 (including) | 8.6.0-patch8 (including) |
| Zimbra_collaboration_suite | Synacor | 8.6.0-patch9 (including) | 8.6.0-patch9 (including) |
| Zimbra_collaboration_suite | Synacor | 8.7.11-p1 (including) | 8.7.11-p1 (including) |
| Zimbra_collaboration_suite | Synacor | 8.7.11-p2 (including) | 8.7.11-p2 (including) |