PT-2024-7260 · Zimbra · Zimbra Collaboration Suite

Published 2024-06-05 · Updated 2025-01-03 · CVE-2024-9665

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Zimbra Collaboration Suite (ZCS) (affected versions not specified)

Description This issue allows remote attackers to disclose sensitive information on affected installations of Zimbra. User interaction is required to exploit this issue, where the target must open a malicious email message. The specific flaw exists within the implementation of the "graphql endpoint". The issue results from the lack of proper protections against cross-site request forgery (CSRF) attacks. An attacker can leverage this issue to disclose information in the context of the target email account.

Recommendations At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

BDU:2024-08609

CVE-2024-9665

ZDI-24-1369

Affected Products

Zimbra Collaboration Suite

References · 12

• https://blog.zimbra.com/2024/10/new-patch-release-reminders-for-missing-attachments-out-of-office-notifications-traffic-light-protocol-tlp-and-mailto-links · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-24-1369 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-9665 · Security Note
• https://osv.dev/vulnerability/CVE-2024-9665 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-08609 · Security Note
• https://wiki.zimbra.com/wiki/Zimbra_Releases/10.0.10 · Note
• https://twitter.com/CVEnew/status/1860073547160527211 · Twitter Post
• https://wiki.zimbra.com/wiki/Zimbra_Releases/10.1.2 · Note
• https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P42 · Note
• https://blog.zimbra.com/2020/08/zimbra-skillz-using-tags-and-graphql-from-a-zimlet · Note
• https://t.me/cvenotify/106271 · Telegram Post
• https://vuldb.com/?id.280187 · Note