high8.8Public exploit code
CVE-2015-6541
Multiple cross-site request forgery (CSRF) vulnerabilities in the Mail interface in Zimbra Collaboration Server (ZCS) before 8.5 allow remote attackers to hija…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Zimbra 8.0.9 GA - Cross-Site Request Forgery2016-02-26 · webapps · linux
Impact
Multiple cross-site request forgery (CSRF) vulnerabilities in the Mail interface in Zimbra Collaboration Server (ZCS) before 8.5 allow remote attackers to hijack the authentication of arbitrary users for requests that change account preferences via a SOAP request to service/soap/BatchRequest.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Zimbra | Zimbra Collaboration Server | through 8.0.9 |
Weakness classification
References
- NVD record
- CVE.org record
- http://seclists.org/fulldisclosure/2016/Feb/121
- https://wiki.zimbra.com/wiki/Security/Collab/86#Notes_from_8.5_.28Jetty.29
- https://www.exploit-db.com/exploits/39500/
- http://seclists.org/fulldisclosure/2016/Feb/121
- https://wiki.zimbra.com/wiki/Security/Collab/86#Notes_from_8.5_.28Jetty.29
- https://www.exploit-db.com/exploits/39500/