CVE-2015-7610: CSRF
First published: Wed May 30 2018(Updated: )
Cross-site request forgery (CSRF) vulnerability in the login form in Zimbra Collaboration Suite (aka ZCS) before 8.6.0 Patch 10, 8.7.x before 8.7.11 Patch 2, and 8.8.x before 8.8.8 Patch 1 allows remote attackers to hijack the authentication of unspecified victims by leveraging failure to use a CSRF token.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Synacor Zimbra Collaboration Suite | >=8.7.0<=8.7.11 | |
| Synacor Zimbra Collaboration Suite | >=8.8.0<=8.8.8 | |
| Synacor Zimbra Collaboration Suite | =8.6.0 | |
| Synacor Zimbra Collaboration Suite | =8.7.11-p1 | |
| Zimbra Zimbra Collaboration Suite | =8.6.0-p1 | |
| Zimbra Zimbra Collaboration Suite | =8.6.0-p2 | |
| Zimbra Zimbra Collaboration Suite | =8.6.0-p3 | |
| Zimbra Zimbra Collaboration Suite | =8.6.0-p4 | |
| Zimbra Zimbra Collaboration Suite | =8.6.0-p5 | |
| Zimbra Zimbra Collaboration Suite | =8.6.0-p6 | |
| Zimbra Zimbra Collaboration Suite | =8.6.0-p7 | |
| Zimbra Zimbra Collaboration Suite | =8.6.0-p8 | |
| Zimbra Zimbra Collaboration Suite | =8.6.0-p9 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://blog.zimbra.com/2018/04/new-patches-for-you-zimbra-8-8-8-turing-patch-1-zimbra-8-7-11-patch-2/
- https://blog.zimbra.com/2018/05/new-patches-zimbra-8-8-8-turing-patch-3-zimbra-8-7-11-patch-3-zimbra-8-6-0-patch-10/
- https://wiki.zimbra.com/wiki/Security_Center
- https://wiki.zimbra.com/wiki/Zimbra_Releases/8.6.0/P10
- https://wiki.zimbra.com/wiki/Zimbra_Releases/8.7.11/P2
- https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.8/P1
- https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories
Frequently Asked Questions
What is the vulnerability ID of this security vulnerability?
The vulnerability ID is CVE-2015-7610.
What is the severity of CVE-2015-7610?
The severity of CVE-2015-7610 is high with a severity value of 8.8.
Which versions of Zimbra Collaboration Suite are affected by CVE-2015-7610?
Zimbra Collaboration Suite versions 8.6.0, 8.7.0 to 8.7.11, and 8.8.0 to 8.8.8 are affected by CVE-2015-7610.
How can remote attackers exploit CVE-2015-7610?
Remote attackers can exploit CVE-2015-7610 by leveraging failure to use a CSRF token in the login form to hijack the authentication of victims.
Where can I find more information about CVE-2015-7610 and patches?
You can find more information about CVE-2015-7610 and patches in the Zimbra Security Center and relevant blog posts on the Zimbra website.
- collector/nvd-index
- agent/tags
- agent/event
- agent/severity
- agent/references
- agent/weakness
- agent/author
- agent/type
- agent/description
- agent/remedy
- agent/first-publish-date
- agent/last-modified-date
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- vendor/synacor
- canonical/synacor zimbra collaboration suite
- version/synacor zimbra collaboration suite/8.7.0
- version/synacor zimbra collaboration suite/8.7.11
- version/synacor zimbra collaboration suite/8.8.0
- version/synacor zimbra collaboration suite/8.8.8
- version/synacor zimbra collaboration suite/8.6.0
- version/synacor zimbra collaboration suite/8.7.11-p1
- vendor/zimbra
- canonical/zimbra zimbra collaboration suite
- version/zimbra zimbra collaboration suite/8.6.0-p1
- version/zimbra zimbra collaboration suite/8.6.0-p2
- version/zimbra zimbra collaboration suite/8.6.0-p3
- version/zimbra zimbra collaboration suite/8.6.0-p4
- version/zimbra zimbra collaboration suite/8.6.0-p5
- version/zimbra zimbra collaboration suite/8.6.0-p6
- version/zimbra zimbra collaboration suite/8.6.0-p7
- version/zimbra zimbra collaboration suite/8.6.0-p8
- version/zimbra zimbra collaboration suite/8.6.0-p9