CVE-2016-3406
HIGHZimbra Collaboration Suite < 8.7.0 - Cross-Site Request Forgery via Client Uploader and REST Handlers
Title source: llmDescription
Multiple cross-site request forgery (CSRF) vulnerabilities in Zimbra Collaboration before 8.7.0 allow remote attackers to hijack the authentication of unspecified victims via vectors involving (1) the Client uploader extension or (2) extension REST handlers, aka bugs 104294 and 104456.
References (5)
Core 5
Core References
Release Notes x_refsource_confirm
https://wiki.zimbra.com/wiki/Zimbra_Releases/8.7.0
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/95890
Issue Tracking, Third Party Advisory x_refsource_confirm
https://bugzilla.zimbra.com/show_bug.cgi?id=104456
Vendor Advisory x_refsource_confirm
https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories
Issue Tracking, Third Party Advisory x_refsource_confirm
https://bugzilla.zimbra.com/show_bug.cgi?id=104294
Scores
CVSS v3
8.8
EPSS
0.0093
EPSS Percentile
56.2%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Details
CWE
CWE-352
Status
published
Products (1)
synacor/zimbra_collaboration_suite
< 8.6.0
Published
Jan 18, 2017
Tracked Since
Feb 18, 2026