CVE-2015-7610

Published: May 30, 2018Modified: Nov 21, 2024

8.8

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: NVD

Description

Cross-site request forgery (CSRF) vulnerability in the login form in Zimbra Collaboration Suite (aka ZCS) before 8.6.0 Patch 10, 8.7.x before 8.7.11 Patch 2, and 8.8.x before 8.8.8 Patch 1 allows remote attackers to hijack the authentication of unspecified victims by leveraging failure to use a CSRF token.

Affected (13)

Products: Synacor: Zimbra Collaboration Suite · Zimbra: Zimbra Collaboration Suite

1 product

Zimbra Collaboration Suite

1 product

Zimbra Collaboration Suite

Configuration A

13 vulnerable

Vulnerable Software	Affected Versions
Synacor Zimbra Collaboration Suite	From 8.7.0 to 8.7.11
Synacor Zimbra Collaboration Suite	From 8.8.0 to 8.8.8
Synacor Zimbra Collaboration Suite	Version 8.6.0
Synacor Zimbra Collaboration Suite	Version 8.7.11 p1
Zimbra Zimbra Collaboration Suite	Version 8.6.0 p1
Zimbra Zimbra Collaboration Suite	Version 8.6.0 p2
Zimbra Zimbra Collaboration Suite	Version 8.6.0 p3
Zimbra Zimbra Collaboration Suite	Version 8.6.0 p4
Zimbra Zimbra Collaboration Suite	Version 8.6.0 p5
Zimbra Zimbra Collaboration Suite	Version 8.6.0 p6
Zimbra Zimbra Collaboration Suite	Version 8.6.0 p7
Zimbra Zimbra Collaboration Suite	Version 8.6.0 p8
Zimbra Zimbra Collaboration Suite	Version 8.6.0 p9

Related CWEs

Cross-Site Request Forgery (CSRF)

The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.

References (14)

https://blog.zimbra.com/2018/04/new-patches-for-you-zimbra-8-8-8-turing-patch-1-zimbra-8-7-11-patch-2/

Source: cve@mitre.org

PatchVendor Advisory

https://blog.zimbra.com/2018/05/new-patches-zimbra-8-8-8-turing-patch-3-zimbra-8-7-11-patch-3-zimbra-8-6-0-patch-10/

Source: cve@mitre.org

PatchVendor Advisory

https://wiki.zimbra.com/wiki/Security_Center

Source: cve@mitre.org

PatchVendor Advisory

https://wiki.zimbra.com/wiki/Zimbra_Releases/8.6.0/P10

Source: cve@mitre.org

PatchRelease NotesVendor Advisory

https://wiki.zimbra.com/wiki/Zimbra_Releases/8.7.11/P2

Source: cve@mitre.org

PatchRelease NotesVendor Advisory

https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.8/P1

Source: cve@mitre.org

PatchRelease NotesVendor Advisory

https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories

Source: cve@mitre.org

PatchVendor Advisory

https://blog.zimbra.com/2018/04/new-patches-for-you-zimbra-8-8-8-turing-patch-1-zimbra-8-7-11-patch-2/

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

https://blog.zimbra.com/2018/05/new-patches-zimbra-8-8-8-turing-patch-3-zimbra-8-7-11-patch-3-zimbra-8-6-0-patch-10/

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

https://wiki.zimbra.com/wiki/Security_Center

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

https://wiki.zimbra.com/wiki/Zimbra_Releases/8.6.0/P10

Source: af854a3a-2127-422b-91ae-364da2661108

PatchRelease NotesVendor Advisory

https://wiki.zimbra.com/wiki/Zimbra_Releases/8.7.11/P2

Source: af854a3a-2127-422b-91ae-364da2661108

PatchRelease NotesVendor Advisory

https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.8/P1

Source: af854a3a-2127-422b-91ae-364da2661108

PatchRelease NotesVendor Advisory

https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

Timeline

No history available yet.