PT-2025-18172 · Zimbra · Zimbra Collaboration

CVE-2025-32354 · Published 2025-04-29 · Updated 2025-05-01

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Zimbra Collaboration (ZCS) versions 9.0 through 10.1

Description A Cross-Site Request Forgery (CSRF) issue exists in the GraphQL endpoint (/service/extension/graphql) of Zimbra webmail due to a lack of CSRF token validation. This allows attackers to perform unauthorized GraphQL operations, such as modifying contacts, changing account settings, and accessing sensitive user data when an authenticated user visits a malicious website.

Recommendations For Zimbra Collaboration (ZCS) versions 9.0 through 10.1, as a temporary workaround, consider disabling the GraphQL endpoint (/service/extension/graphql) until a patch is available. Restrict access to the GraphQL endpoint to minimize the risk of exploitation. Avoid using the GraphQL endpoint for sensitive operations until the issue is resolved.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

BDU:2025-12727

CVE-2025-32354

Affected Products

Zimbra Collaboration

References · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/32xxx/CVE-2025-32354.json · Exploit
• https://wiki.zimbra.com/wiki/Security_Center · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-32354 · Security Note
• https://osv.dev/vulnerability/CVE-2025-32354 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-12727 · Security Note
• https://twitter.com/UndercodeNews/status/1917540244221575197 · Twitter Post
• https://wiki.zimbra.com/wiki/Zimbra_Releases/10.1.4#Security_Fixes · Note
• https://twitter.com/TweetThreatNews/status/1917742187833442399 · Twitter Post
• https://wiki.zimbra.com/wiki/Zimbra_Responsible_Disclosure_Policy · Note
• https://t.me/cvetracker/22625 · Telegram Post
• https://t.me/cvedetector/24023 · Telegram Post
• https://twitter.com/CVEnew/status/1917245413893063025 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1917315399638520040 · Twitter Post
• https://twitter.com/f1tym1/status/1917511693719986271 · Twitter Post
• https://twitter.com/syedaquib77/status/1917670980039893007 · Twitter Post