PT-2022-23766 · Zimbra · Zimbra Collaboration Suite

Published 2022-08-11 · Updated 2022-08-16 · CVE-2022-37043

Positive Technologies (AI Summary)

CVSS v3.1

5.7

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Zimbra Collaboration Suite (ZCS) versions 8.8.15 through 9.0

Description An issue in the webmail component of Zimbra Collaboration Suite allows for a request to be sent to the application without a CSRF token when an authenticated user views an attacker-controlled page, and the request still succeeds due to the omission of CSRF token checks on some POST endpoints.

Recommendations For versions 8.8.15 and 9.0, consider temporarily disabling the preauth feature until a patch is available to prevent exploitation of this issue. Restrict access to the webmail component to minimize the risk of exploitation. Avoid using the affected POST endpoints until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2022-37043

Affected Products

Zimbra Collaboration Suite

References · 5

• https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-37043 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-37043 · Security Note
• https://wiki.zimbra.com/wiki/Security_Center · Vendor Advisory
• https://t.me/cibsecurity/48035 · Telegram Post