CVE-2015-7610

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2015-7610
Cross-site request forgery (CSRF) vulnerability in the login form in Zimbra Collaboration Suite (aka ZCS) before 8.6.0 Patch 10, 8.7.x before 8.7.11 Patch 2, and 8.8.x before 8.8.8 Patch 1 allows remote attackers to hijack the authentication of unspecified victims by leveraging failure to use a CSRF token.

8.8 /10

CVSS v3 : HIGH

V3 Legend

Vector : AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

6.8 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability : 8.6 / Impact : 6.4

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References
Link Resource
https://blog.zimbra.com/2018/04/new-patches-for-you-zimbra-8-8-8-turing-patch-1-zimbra-8-7-11-patch-2/ Patch Vendor Advisory
https://blog.zimbra.com/2018/05/new-patches-zimbra-8-8-8-turing-patch-3-zimbra-8-7-11-patch-3-zimbra-8-6-0-patch-10/ Patch Vendor Advisory
https://wiki.zimbra.com/wiki/Security_Center Patch Vendor Advisory
https://wiki.zimbra.com/wiki/Zimbra_Releases/8.6.0/P10 Patch Release Notes Vendor Advisory
https://wiki.zimbra.com/wiki/Zimbra_Releases/8.7.11/P2 Patch Release Notes Vendor Advisory
https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.8/P1 Patch Release Notes Vendor Advisory
https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories Patch Vendor Advisory
https://blog.zimbra.com/2018/04/new-patches-for-you-zimbra-8-8-8-turing-patch-1-zimbra-8-7-11-patch-2/ Patch Vendor Advisory
https://blog.zimbra.com/2018/05/new-patches-zimbra-8-8-8-turing-patch-3-zimbra-8-7-11-patch-3-zimbra-8-6-0-patch-10/ Patch Vendor Advisory
https://wiki.zimbra.com/wiki/Security_Center Patch Vendor Advisory
https://wiki.zimbra.com/wiki/Zimbra_Releases/8.6.0/P10 Patch Release Notes Vendor Advisory
https://wiki.zimbra.com/wiki/Zimbra_Releases/8.7.11/P2 Patch Release Notes Vendor Advisory
https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.8/P1 Patch Release Notes Vendor Advisory
https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories Patch Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:synacor:zimbra_collaboration_suite:*:*:*:*:*:*:*:*
cpe:2.3:a:synacor:zimbra_collaboration_suite:*:*:*:*:*:*:*:*
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.6.0:*:*:*:*:*:*:*
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.7.11:p1:*:*:*:*:*:*
cpe:2.3:a:zimbra:zimbra_collaboration_suite:8.6.0:p1:*:*:*:*:*:*
cpe:2.3:a:zimbra:zimbra_collaboration_suite:8.6.0:p2:*:*:*:*:*:*
cpe:2.3:a:zimbra:zimbra_collaboration_suite:8.6.0:p3:*:*:*:*:*:*
cpe:2.3:a:zimbra:zimbra_collaboration_suite:8.6.0:p4:*:*:*:*:*:*
cpe:2.3:a:zimbra:zimbra_collaboration_suite:8.6.0:p5:*:*:*:*:*:*
cpe:2.3:a:zimbra:zimbra_collaboration_suite:8.6.0:p6:*:*:*:*:*:*
cpe:2.3:a:zimbra:zimbra_collaboration_suite:8.6.0:p7:*:*:*:*:*:*
cpe:2.3:a:zimbra:zimbra_collaboration_suite:8.6.0:p8:*:*:*:*:*:*
cpe:2.3:a:zimbra:zimbra_collaboration_suite:8.6.0:p9:*:*:*:*:*:*
History

No history.

Information

Published : 2018-05-30 21:29

Updated : 2024-11-21 02:37

NVD link : CVE-2015-7610

Mitre link : CVE-2015-7610

CVE.ORG link : CVE-2015-7610

JSON object : View

Products Affected

synacor

  • zimbra_collaboration_suite

zimbra

  • zimbra_collaboration_suite
CWE
CWE-352

Cross-Site Request Forgery (CSRF)