CVE-2022-37043: CSRF
An issue was discovered in the webmail component in Zimbra Collaboration Suite (ZCS) 8.8.15 and 9.0. When using preauth, CSRF tokens are not checked on some POST endpoints. Thus, when an authenticated user views an attacker-controlled page, a request will be sent to the application that appears to be intended. The CSRF token is omitted from the request, but the request still succeeds.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2022-37043?
CVE-2022-37043 is a vulnerability discovered in the webmail component of Zimbra Collaboration Suite (ZCS) versions 8.8.15 and 9.0.
What is the severity of CVE-2022-37043?
CVE-2022-37043 has a severity rating of 5.7, which is considered medium.
How does CVE-2022-37043 affect Zimbra Collaboration Suite (ZCS)?
CVE-2022-37043 affects Zimbra Collaboration Suite (ZCS) versions 8.8.15 and 9.0 by allowing CSRF tokens to not be checked on some POST endpoints when using preauth.
How can an attacker exploit CVE-2022-37043?
An attacker can exploit CVE-2022-37043 by directing an authenticated user to an attacker-controlled page, which triggers a request to the application without the CSRF token check.
Is there a fix for CVE-2022-37043?
Yes, it is recommended to update Zimbra Collaboration Suite (ZCS) to a version that includes a patch for CVE-2022-37043.