====================================== Multiple CSRF in Zimbra Mail interface ====================================== CVE-2015-6541 Description =========== Multiple CSRF vulnerabilities have been found in the Mail interface of Zimbra 8.0.9 GA Release, enabling to change account preferences like e-mail forwarding. CSRF ==== Forms in the preferences part of old releases of Zimbra are vulnerable to CSRF because of the lack of a CSRF token identifying a valid session. As a consequence, requests can be forged and played arbitrarily. **Access Vector**: remote **Security Risk**: low **Vulnerability**: CWE-352 **CVSS Base score**: 5.8 ---------------- Proof of Concept ---------------- Solution ======== Sensitive forms should be protected by a CSRF token. Fixes ===== Fixed with 8.5 release : bug 83547 (https://wiki.zimbra.com/wiki/Security/Collab/86#Notes_from_8.5) Affected versions ================= * Zimbra <= 8.0.9 GA Release Credits ======= * Anthony LAOU-HINE TSUEI, Sysdream (laouhine_anthony -at- hotmail -dot- fr) * Damien CAUQUIL, Sysdream (d.cauquil -at- sysdream -dot- com) -- SYSDREAM Labs GPG : 47D1 E124 C43E F992 2A2E 1551 8EB4 8CD9 D5B2 59A1 * Website: https://sysdream.com/ * Twitter: @sysdream