PT-2025-51284 · Yahoo+1 · Flickr+1

Published 2025-12-15 · Updated 2025-12-31 · CVE-2025-67809

Positive Technologies (AI Summary)

CVSS v3.1

4.7

Medium

Base vector

AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Zimbra Collaboration versions 10.0 and 10.1

Description A hardcoded Flickr API key and secret are present in the publicly accessible Flickr Zimlet used by Zimbra Collaboration. An attacker with access to these credentials could impersonate the legitimate application and initiate valid Flickr OAuth flows. If a user is tricked into approving such a request, the attacker could gain access to the user’s Flickr data. The hardcoded credentials have been removed from the Zimlet code, and the associated key has been revoked.

Recommendations Update to a version where the hardcoded credentials have been removed.

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2025-67809

Affected Products

Flickr

Zimbra Collaboration

References · 9

• https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-67809 · Security Note
• https://osv.dev/vulnerability/CVE-2025-67809 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/2000776503957627020 · Twitter Post
• https://twitter.com/transilienceai/status/2006206425752567930 · Twitter Post
• https://twitter.com/CVEnew/status/2002857403600253261 · Twitter Post
• https://t.me/cveNotify/147217 · Telegram Post
• https://wiki.zimbra.com/wiki/Zimbra_Responsible_Disclosure_Policy · Note
• https://wiki.zimbra.com/wiki/Security_Center · Note