CVE-2024-9665 Zimbra GraphQL Cross-Site Request Forgery Information Disclosure Vulnerability
Remote attackers can disclose sensitive information from Zimbra email accounts via CSRF by tricking users into opening malicious emails.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2024-9665?
CVE-2024-9665 is a medium-severity vulnerability in Zimbra, published on 22 Nov 2024. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Zimbra GraphQL Cross-Site Request Forgery Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Zimbra. User interaction is required to exploit this vulnerability in that the target must open a malicious email message.
The specific flaw exists within the implementation of the graphql endpoint. The issue results from the lack of proper protections against cross-site request forgery (CSRF) attacks. An attacker can leverage this vulnerability to disclose information in the context of the target email account. Was ZDI-CAN-23939.
Weakness: CWE-352
Which versions are affected by CVE-2024-9665?
It affects 1 product.
Products include Zimbra Zimbra.
How do I fix CVE-2024-9665?
No fix has been published for CVE-2024-9665 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-9665 being exploited?
There is no known exploitation of CVE-2024-9665 in the wild and no public exploit code.
Other vulnerabilities in Zimbra
Sources
Also known as GHSA-r864-j7x7-66f2.