CVEvulnerability
CVE-2016-3406
8.8 HIGH
Official page ↗
- Status
- Modified
- Published
- 2017-01-18
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 8.8 HIGH — CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 6.8 MEDIUM — AV:N/AC:M/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-352
Description
Multiple cross-site request forgery (CSRF) vulnerabilities in Zimbra Collaboration before 8.7.0 allow remote attackers to hijack the authentication of unspecified victims via vectors involving (1) the Client uploader extension or (2) extension REST handlers, aka bugs 104294 and 104456.
Affected configurations
• synacor zimbra collaboration suite (<= 8.6.0)
Related
Weakness · CWE (1)
- CWE-352 Cross-Site Request Forgery weakness
References
- http://www.securityfocus.com/bid/95890 www.securityfocus.com
- https://bugzilla.zimbra.com/show_bug.cgi?id=104294 Issue Tracking, Third Party Advisory
- https://bugzilla.zimbra.com/show_bug.cgi?id=104456 Issue Tracking, Third Party Advisory
- https://wiki.zimbra.com/wiki/Zimbra_Releases/8.7.0 Release Notes
- https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories Vendor Advisory
- http://www.securityfocus.com/bid/95890 www.securityfocus.com
- https://bugzilla.zimbra.com/show_bug.cgi?id=104294 Issue Tracking, Third Party Advisory
- https://bugzilla.zimbra.com/show_bug.cgi?id=104456 Issue Tracking, Third Party Advisory
- https://wiki.zimbra.com/wiki/Zimbra_Releases/8.7.0 Release Notes
- https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories Vendor Advisory