GraphQL Information Disclosure Vulnerability in Zimbra

CVE-2024-9665

What is CVE-2024-9665?

The GraphQL endpoint of Zimbra Collaboration Suite is exposed to a Cross-Site Request Forgery (CSRF) vulnerability, which can be exploited by remote attackers to access sensitive information related to the user’s email account. Exploitation requires user interaction, where the victim must open a malicious email. This vulnerability stems from inadequate CSRF protection, allowing attackers to manipulate requests in the context of the target's session, thereby compromising sensitive data. For users of Zimbra, it is essential to ensure that the latest security patches are applied to mitigate the risks associated with this flaw.

References