# CVE-2016-3403: Multiple CSRF in Zimbra Administration interface ## Description Multiple CSRF vulnerabilities have been found in the administration interface of Zimbra, giving possibilities like adding, modifying and removing admin accounts. ## Vulnerability Every forms in the Administration part of Zimbra are vulnerable to CSRF because of the lack of a CSRF token identifying a valid session. As a consequence, requests can be forged and played arbitrarily. **Access Vector**: remote **Security Risk**: low **Vulnerability**: CWE-352 **CVSS Base score**: 5.8 ## Proof of Concept ```html ``` ## Solution * Upgrade to version 8.7 ## Affected versions * All versions previous to 8.7 ## Fixes * https://bugzilla.zimbra.com/show_bug.cgi?id=100885 * https://bugzilla.zimbra.com/show_bug.cgi?id=100899 ## Timeline (dd/mm/yyyy) * 24/02/2016: Issue reported to Zimbra * 24/02/2016: Issue aknwoledged * 20/06/2016: complete fixes released with version 8.7 ## Credits * Anthony LAOU-HINE TSUEI, Sysdream (laouhine_anthony -at- hotmail -dot- fr) * Damien CAUQUIL, Sysdream (d.cauquil -at- sysdream -dot- com)