CVE-2025-54390: CSRF
A Cross-Site Request Forgery (CSRF) vulnerability exists in the ResetPasswordRequest operation of Zimbra Collaboration (ZCS) when the zimbraFeatureResetPasswordStatus attribute is enabled. An attacker can exploit this by tricking an authenticated user into visiting a malicious webpage that silently sends a crafted SOAP request to reset the user's password. The vulnerability stems from a lack of CSRF token validation on the endpoint, allowing password resets without the user's consent.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-54390?
CVE-2025-54390 is considered a high-severity vulnerability due to its potential for exploitation through CSRF.
How do I fix CVE-2025-54390?
To mitigate CVE-2025-54390, disable the zimbraFeatureResetPasswordStatus attribute if it is not required.
Who is affected by CVE-2025-54390?
CVE-2025-54390 affects users of Zimbra Collaboration with the zimbraFeatureResetPasswordStatus attribute enabled.
What type of vulnerability is CVE-2025-54390?
CVE-2025-54390 is classified as a Cross-Site Request Forgery (CSRF) vulnerability.
Can CVE-2025-54390 be exploited remotely?
Yes, CVE-2025-54390 can be exploited remotely by tricking an authenticated user into visiting a malicious webpage.