Zimbra Collaboration Hardcoded Flickr API Credentials Vulnerability

A vulnerability exists in Zimbra Collaboration (ZCS) versions 10.0 and 10.1 due to hardcoded Flickr API credentials in the publicly accessible Flickr Zimlet. These credentials, embedded directly in the Zimlet, can be retrieved by unauthorized parties and misused to access users' Flickr data by initiating valid OAuth flows, potentially leading to unauthorized data access. The credentials have since been removed and the associated key revoked.

Impact

Exploitation allows unauthorized access to users' Flickr data via misused OAuth flows, impersonating the legitimate application.

Remediation

Users can upgrade to ZCS versions 10.1.13 or 10.0.18, both of which include the removal of the hardcoded Flickr API credentials.