CVE-2015-7610

Severity: high (CVSS 8.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-05-30 · updated 2026-06-17
Weakness: CWE-352

Description

Cross-site request forgery (CSRF) vulnerability in the login form in Zimbra Collaboration Suite (aka ZCS) before 8.6.0 Patch 10, 8.7.x before 8.7.11 Patch 2, and 8.8.x before 8.8.8 Patch 1 allows remote attackers to hijack the authentication of unspecified victims by leveraging failure to use a CSRF token.

Affected products

Zimbra Collaboration: from 8.7.0 through 8.7.11; from 8.8.0 through 8.8.8; 8.6.0, 8.7.11-p1
Zimbra Collaboration Suite: 8.6.0-p1, 8.6.0-p2, 8.6.0-p3, 8.6.0-p4, 8.6.0-p5, 8.6.0-p6 (+3)

References

https://blog.zimbra.com/2018/04/new-patches-for-you-zimbra-8-8-8-turing-patch-1-zimbra-8-7-11-patch-2/
https://blog.zimbra.com/2018/05/new-patches-zimbra-8-8-8-turing-patch-3-zimbra-8-7-11-patch-3-zimbra-8-6-0-patch-10/
https://wiki.zimbra.com/wiki/Security_Center
https://wiki.zimbra.com/wiki/Zimbra_Releases/8.6.0/P10
https://wiki.zimbra.com/wiki/Zimbra_Releases/8.7.11/P2
https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.8/P1
https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories
https://blog.zimbra.com/2018/04/new-patches-for-you-zimbra-8-8-8-turing-patch-1-zimbra-8-7-11-patch-2/
https://blog.zimbra.com/2018/05/new-patches-zimbra-8-8-8-turing-patch-3-zimbra-8-7-11-patch-3-zimbra-8-6-0-patch-10/
https://wiki.zimbra.com/wiki/Security_Center
https://wiki.zimbra.com/wiki/Zimbra_Releases/8.6.0/P10
https://wiki.zimbra.com/wiki/Zimbra_Releases/8.7.11/P2

Get alerted when CVE-2015-7610 or the next vulnerability affects your stack