An LDAP injection flaw exists in the Mailbox SOAP service of Zimbra Collaboration Suite 10.0 and 10.1. The vulnerability allows an authenticated attacker to inject crafted LDAP search filters through a FolderAction SOAP request, enabling the retrieval of sensitive directory attributes. This can lead to confidentiality compromise, exposing user attributes such as email addresses and directory entries that should remain private.

The flaw affects Zimbra Collaboration Suite 10.0 and 10.1. This includes the ZCS product received from Synacor. Versions prior to 10.0 and later releases beyond 10.1 are not listed as affected in the CNA data.

The CVSS base score of 4.3 indicates a moderate impact, while the EPSS score of less than 1% suggests a low likelihood of exploitation in the wild. The attack requires valid authentication, meaning attackers need compromised credentials or privileged access. The vulnerability is not currently listed in the CISA KEV catalog. Despite the limited exploitation window, the ability to expose sensitive directory information warrants prompt remediation.