CVE-2024-9665
Zimbra GraphQL Cross-Site Request Forgery Information Disclosure Vulnerability
- State
- Published
- Severity
- 6.5 Medium
- Published
- Nov 22, 2024
- Updated
- Nov 23, 2024
- Reserved
- Oct 8, 2024
Description
Zimbra GraphQL Cross-Site Request Forgery Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Zimbra. User interaction is required to exploit this vulnerability in that the target must open a malicious email message.
The specific flaw exists within the implementation of the graphql endpoint. The issue results from the lack of proper protections against cross-site request forgery (CSRF) attacks. An attacker can leverage this vulnerability to disclose information in the context of the target email account. Was ZDI-CAN-23939.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.0 | 6.5 Medium | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N | zdi |
Weaknesses
- CWE-352 Cross-Site Request Forgery (CSRF)
Affected Products
| Product | Versions |
|---|---|
ZimbraZimbra |
|
References
- ZDI-24-1369
- vendor-provided URLvendor-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.