CVE-2013-5119
Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.
NVD · uneditedZimbra Collaboration Suite (ZCS) 6.0.16 and earlier allows man-in-the-middle attackers to obtain access by sniffing the network and replaying the ZM_AUTH_TOKEN token.
Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.
dbcve analysis · moderate confidenceZimbra Collaboration Suite 6.0.16 and earlier transmits the ZM_AUTH_TOKEN authentication token in cleartext or without adequate protection, allowing a man-in-the-middle attacker positioned on the network to sniff the token and replay it to gain unauthorized access to the system.
Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.
Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.
NVD · CPE data<= 6.0.16= 6.0.0= 6.0.1= 6.0.2= 6.0.3= 6.0.4= 6.0.5= 6.0.6= 6.0.7= 6.0.8= 6.0.9= 6.0.10CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.
From the vector- Attack vector
- Network
- Complexity
- M
- Authentication
- None
- Confidentiality
- Partial
- Integrity
- Partial
- Availability
- Partial
AV:N/AC:M/Au:N/C:P/I:P/A:P
Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.
dbcve checksWork through these to decide whether this CVE applies to you.
-
Identify Zimbra versionRun 'zmcontrol -v' as the zimbra user or check the installed package version via 'rpm -q zimbra-common-core-jar' or dpkg queryAffected if Version is 6.0.16 or earlier (6.0.0 through 6.0.10 are explicitly listed)
-
Verify HTTPS enforcement for webmailAttempt to access the webmail interface via HTTP (port 80) and HTTPS (port 443). Check if HTTP redirects to HTTPS or is blocked. Also run 'zmprov gs $(hostname) zimbraMailMode' to check the configured mail modeAffected if HTTP (non-TLS) access is allowed or zimbraMailMode is set to 'http' or 'both' instead of 'https' or 'redirect'
-
Verify HTTPS enforcement for admin interfaceAttempt to access the admin console via HTTP and HTTPS. Run 'zmprov gs $(hostname) zimbraAdminMailMode' to check admin interface configurationAffected if Admin console is accessible over HTTP without redirect to HTTPS
-
Check SSL/TLS configurationReview Zimbra SSL configuration via 'zmlocalconfig -s ssl' or check the nginx proxy configuration if present. Verify that SSL is properly configured and enabled for all web servicesAffected if SSL is not properly configured or is disabled for critical web services
-
Inspect network traffic (if possible)Use a network capture tool on the Zimbra server to observe if the ZM_AUTH_TOKEN cookie or parameter is transmitted over unencrypted HTTP during login or authenticated requestsAffected if ZM_AUTH_TOKEN is observed in cleartext over HTTP
You are affected if your Zimbra version is 6.0.16 or earlier and HTTP (non-TLS) access is enabled for webmail or admin interfaces, allowing the authentication token to be transmitted in cleartext.
Generated from the published advisory. Verify against your own configuration.
Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.
From vendor dataEnforce TLS/HTTPS for all ZCS web traffic and implement proper network segmentation or VPN access to prevent MITM attacks. Consider upgrading to a patched version if available.
- Consultation4.0 h
- Implementation8.0 h
- Testing4.0 h
- Review / QA2.0 h
An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $5,120.
Scan for this in your stack
Free · runs locallyCheck whether your project pulls in CVE-2013-5119 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.
References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.
Primary sourcesPractitioner notes
ContributedPeer-ranked notes from engineers who’ve handled CVE-2013-5119 in production — separate from our analysis above.
The advisory tells you what broke. It rarely tells you what actually worked. If you’ve dealt with this one, that detail is what the next engineer is searching for.
- The version that genuinely resolved it — not the one the vendor claimed
- A config change or rule that shut the vector down
- A gotcha in the upgrade path that cost you an afternoon
No notes yet
Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.
A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.
- Verified mitigations, workarounds, and config changes
- Version or environment caveats, and links to real fixes
- No weaponised exploit code, or anything meant to cause harm
- No spam, self-promotion, credentials, or personal data