Zimbra Collaboration Cross-Site Request Forgery Vulnerability in Webmail

A cross-site request forgery (CSRF) vulnerability has been identified in Zimbra Collaboration (ZCS) versions 10.0 and 10.1. This vulnerability arises from improper validation of CSRF tokens in Zimbra Webmail, allowing attackers to exploit the issue by tricking authenticated users into submitting crafted requests. The application mistakenly accepts CSRF tokens from the request body instead of the required header, potentially enabling unauthorized actions on behalf of the user.

Impact

Exploitation of this vulnerability could lead to unauthorized actions being performed on behalf of the victim user.

Remediation

Users can upgrade to ZCS versions 10.1.13 or 10.0.18, both of which include the necessary security fix. Instructions for upgrading can be found on the Zimbra Releases page.