← Volver a CVEs

CVE-2026-33372

MEDIUM

5.4

Descripcion

An issue was discovered in Zimbra Collaboration (ZCS) 10.0 and 10.1. A cross-site request forgery (CSRF) vulnerability exists in Zimbra Webmail due to improper validation of CSRF tokens. The application accepts CSRF tokens supplied within the request body instead of requiring them through the expected request header. An attacker can exploit this issue by tricking an authenticated user into submitting a crafted request. This may allow unauthorized actions to be performed on behalf of the victim.

Detalles CVE

Puntuacion CVSS v3.15.4

SeveridadMEDIUM

Vector CVSSCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Vector de ataqueNETWORK

ComplejidadLOW

Privilegios requeridosNONE

Interaccion usuarioREQUIRED

Publicado3/20/2026

Ultima modificacion4/1/2026

Fuentenvd

Avistamientos honeypot0

Productos afectados

synacor:zimbra_collaboration_suite

Debilidades (CWE)

CWE-352

Referencias

https://wiki.zimbra.com/wiki/Security_Center(cve@mitre.org)

https://wiki.zimbra.com/wiki/Zimbra_Releases/10.1.16#Security_Fixes(cve@mitre.org)

https://wiki.zimbra.com/wiki/Zimbra_Responsible_Disclosure_Policy(cve@mitre.org)

https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories(cve@mitre.org)

Correlaciones IOC

Sin correlaciones registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.