CVE-2022-37043

An issue was discovered in the webmail component in Zimbra Collaboration Suite (ZCS) 8.8.15 and 9.0

published August 11, 2022

CVSS
—
EPSS
0%
Percentile
28.1
In the wild
Unconfirmed
What it is

An issue was discovered in the webmail component in Zimbra Collaboration Suite (ZCS) 8.8.15 and 9.0. When using preauth, CSRF tokens are not checked on some POST endpoints. Thus, when an authenticated user views an attacker-controlled page, a request will be sent to the application that appears to be intended. The CSRF token is omitted from the request, but the request still succeeds.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00356 · 28.1th percentile
Published
2022-08-11T19:40Z
EPSS history
Timeline
  • 11 AUG 19:40Z
    An issue was discovered in the webmail component in Zimbra Collaboration Suite (ZCS) 8.8.15 and 9.0
    cvelistv5