CVE-2024-9665 - Vulnerability Details

Vendors	Products
Zimbra	Zimbra

Link	Providers
https://blog.zimbra.com/2024/10/new-patch-release-reminders-for-missing-attachments-out-of-office-notifications-traffic-light-protocol-tlp-and-mailto-links/
https://www.zerodayinitiative.com/advisories/ZDI-24-1369/

Type	Values Removed	Values Added
First Time appeared		Zimbra Zimbra zimbra
CPEs		cpe:2.3:a:zimbra:zimbra:::::::: cpe:2.3:a:zimbra:zimbra:9.0.0:p0:::::: cpe:2.3:a:zimbra:zimbra:9.0.0:p19:::::: cpe:2.3:a:zimbra:zimbra:9.0.0:p23:::::: cpe:2.3:a:zimbra:zimbra:9.0.0:p25:::::: cpe:2.3:a:zimbra:zimbra:9.0.0:p26:::::: cpe:2.3:a:zimbra:zimbra:9.0.0:p27:::::: cpe:2.3:a:zimbra:zimbra:9.0.0:p28:::::: cpe:2.3:a:zimbra:zimbra:9.0.0:p30:::::: cpe:2.3:a:zimbra:zimbra:9.0.0:p31:::::: cpe:2.3:a:zimbra:zimbra:9.0.0:p33:::::: cpe:2.3:a:zimbra:zimbra:9.0.0:p34:::::: cpe:2.3:a:zimbra:zimbra:9.0.0:p35:::::: cpe:2.3:a:zimbra:zimbra:9.0.0:p36:::::: cpe:2.3:a:zimbra:zimbra:9.0.0:p37:::::: cpe:2.3:a:zimbra:zimbra:9.0.0:p38:::::: cpe:2.3:a:zimbra:zimbra:9.0.0:p39:::::: cpe:2.3:a:zimbra:zimbra:9.0.0:p40:::::: cpe:2.3:a:zimbra:zimbra:9.0.0:p41:::::: cpe:2.3:a:zimbra:zimbra:9.0.0:p4:::::: cpe:2.3:a:zimbra:zimbra:9.0.0:p7.1:::::: cpe:2.3:a:zimbra:zimbra:9.0.0:p7::::::
Vendors & Products		Zimbra Zimbra zimbra
Metrics		cvssV3_1 `{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N'}`

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Type	Values Removed	Values Added
Description		Zimbra GraphQL Cross-Site Request Forgery Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Zimbra. User interaction is required to exploit this vulnerability in that the target must open a malicious email message. The specific flaw exists within the implementation of the graphql endpoint. The issue results from the lack of proper protections against cross-site request forgery (CSRF) attacks. An attacker can leverage this vulnerability to disclose information in the context of the target email account. Was ZDI-CAN-23939.
Title		Zimbra GraphQL Cross-Site Request Forgery Information Disclosure Vulnerability
Weaknesses		CWE-352
References		https://blog.zimbra.com/2024/10/new-patch-release-reminders-for-missing-attachments-out-of-office-notifications-traffic-light-protocol-tlp-and-mailto-links/ https://www.zerodayinitiative.com/advisories/ZDI-24-1369/
Metrics		cvssV3_0 `{'score': 6.5, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N'}`

Show plain JSON

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-9665", "assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e", "state": "PUBLISHED", "assignerShortName": "zdi", "dateReserved": "2024-10-08T22:22:05.000Z", "datePublished": "2024-11-22T21:02:44.953Z", "dateUpdated": "2024-11-23T01:26:27.732Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "99f1926a-a320-47d8-bbb5-42feb611262e", "shortName": "zdi", "dateUpdated": "2024-11-22T21:02:44.953Z"}, "title": "Zimbra GraphQL Cross-Site Request Forgery Information Disclosure Vulnerability", "descriptions": [{"lang": "en", "value": "Zimbra GraphQL Cross-Site Request Forgery Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Zimbra. User interaction is required to exploit this vulnerability in that the target must open a malicious email message.\n\nThe specific flaw exists within the implementation of the graphql endpoint. The issue results from the lack of proper protections against cross-site request forgery (CSRF) attacks. An attacker can leverage this vulnerability to disclose information in the context of the target email account. Was ZDI-CAN-23939."}], "affected": [{"vendor": "Zimbra", "product": "Zimbra", "versions": [{"version": "10.0.8", "status": "affected"}], "defaultStatus": "unknown"}], "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-352", "description": "CWE-352: Cross-Site Request Forgery (CSRF)", "type": "CWE"}]}], "references": [{"url": "https://www.zerodayinitiative.com/advisories/ZDI-24-1369/", "name": "ZDI-24-1369", "tags": ["x_research-advisory"]}, {"url": "https://blog.zimbra.com/2024/10/new-patch-release-reminders-for-missing-attachments-out-of-office-notifications-traffic-light-protocol-tlp-and-mailto-links/", "name": "vendor-provided URL", "tags": ["vendor-advisory"]}], "dateAssigned": "2024-10-08T17:22:05.123-05:00", "datePublic": "2024-10-11T17:03:24.864-05:00", "source": {"lang": "en", "value": "Anonymous"}, "metrics": [{"format": "CVSS", "cvssV3_0": {"version": "3.0", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "baseScore": 6.5, "baseSeverity": "MEDIUM"}}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-9665", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-11-23T01:19:46.807745Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-11-23T01:26:27.732Z"}}]}}

{

dataType : CVE_RECORD (string)

dataVersion : 5.1 (string)

cveMetadata : { »

cveId : CVE-2024-9665 (string)

assignerOrgId : 99f1926a-a320-47d8-bbb5-42feb611262e (string)

state : PUBLISHED (string)

assignerShortName : zdi (string)

dateReserved : 2024-10-08T22:22:05.000Z (string)

datePublished : 2024-11-22T21:02:44.953Z (string)

dateUpdated : 2024-11-23T01:26:27.732Z (string)

}

containers : { »

cna : { »

providerMetadata : { »

orgId : 99f1926a-a320-47d8-bbb5-42feb611262e (string)

shortName : zdi (string)

dateUpdated : 2024-11-22T21:02:44.953Z (string)

}

title : Zimbra GraphQL Cross-Site Request Forgery Information Disclosure Vulnerability (string)

descriptions : [ »

0 : { »

lang : en (string)

value : Zimbra GraphQL Cross-Site Request Forgery Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Zimbra. User interaction is required to exploit this vulnerability in that the target must open a malicious email message. The specific flaw exists within the implementation of the graphql endpoint. The issue results from the lack of proper protections against cross-site request forgery (CSRF) attacks. An attacker can leverage this vulnerability to disclose information in the context of the target email account. Was ZDI-CAN-23939. (string)

}

]

affected : [ »

0 : { »

vendor : Zimbra (string)

product : Zimbra (string)

versions : [ »

0 : { »

version : 10.0.8 (string)

status : affected (string)

}

]

defaultStatus : unknown (string)

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

lang : en (string)

cweId : CWE-352 (string)

description : CWE-352: Cross-Site Request Forgery (CSRF) (string)

type : CWE (string)

}

]

}

]

references : [ »

0 : { »

url : https://www.zerodayinitiative.com/advisories/ZDI-24-1369/ (string)

name : ZDI-24-1369 (string)

tags : [ »

0 : x_research-advisory (string)

]

}

1 : { »

url : https://blog.zimbra.com/2024/10/new-patch-release-reminders-for-missing-attachments-out-of-office-notifications-traffic-light-protocol-tlp-and-mailto-links/ (string)

name : vendor-provided URL (string)

tags : [ »

0 : vendor-advisory (string)

]

}

]

dateAssigned : 2024-10-08T17:22:05.123-05:00 (string)

datePublic : 2024-10-11T17:03:24.864-05:00 (string)

source : { »

lang : en (string)

value : Anonymous (string)

}

metrics : [ »

0 : { »

format : CVSS (string)

cvssV3_0 : { »

version : 3.0 (string)

vectorString : CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N (string)

baseScore : 6.5 (number)

baseSeverity : MEDIUM (string)

}

]

}

adp : [ »

0 : { »

metrics : [ »

0 : { »

other : { »

type : ssvc (string)

content : { »

id : CVE-2024-9665 (string)

role : CISA Coordinator (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : partial (string)

}

]

version : 2.0.3 (string)

timestamp : 2024-11-23T01:19:46.807745Z (string)

}

]

title : CISA ADP Vulnrichment (string)

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2024-11-23T01:26:27.732Z (string)

}

]

}

Show plain JSON

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-9665", "assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e", "state": "PUBLISHED", "assignerShortName": "zdi", "dateReserved": "2024-10-08T22:22:05.000Z", "datePublished": "2024-11-22T21:02:44.953Z", "dateUpdated": "2024-11-22T21:02:44.953Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "99f1926a-a320-47d8-bbb5-42feb611262e", "shortName": "zdi", "dateUpdated": "2024-11-22T21:02:44.953Z"}, "title": "Zimbra GraphQL Cross-Site Request Forgery Information Disclosure Vulnerability", "descriptions": [{"lang": "en", "value": "Zimbra GraphQL Cross-Site Request Forgery Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Zimbra. User interaction is required to exploit this vulnerability in that the target must open a malicious email message.\n\nThe specific flaw exists within the implementation of the graphql endpoint. The issue results from the lack of proper protections against cross-site request forgery (CSRF) attacks. An attacker can leverage this vulnerability to disclose information in the context of the target email account. Was ZDI-CAN-23939."}], "affected": [{"vendor": "Zimbra", "product": "Zimbra", "versions": [{"version": "10.0.8", "status": "affected"}], "defaultStatus": "unknown"}], "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-352", "description": "CWE-352: Cross-Site Request Forgery (CSRF)", "type": "CWE"}]}], "references": [{"url": "https://www.zerodayinitiative.com/advisories/ZDI-24-1369/", "name": "ZDI-24-1369", "tags": ["x_research-advisory"]}, {"url": "https://blog.zimbra.com/2024/10/new-patch-release-reminders-for-missing-attachments-out-of-office-notifications-traffic-light-protocol-tlp-and-mailto-links/", "name": "vendor-provided URL", "tags": ["vendor-advisory"]}], "dateAssigned": "2024-10-08T17:22:05.123-05:00", "datePublic": "2024-10-11T17:03:24.864-05:00", "source": {"lang": "en", "value": "Anonymous"}, "metrics": [{"format": "CVSS", "cvssV3_0": {"version": "3.0", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "baseScore": 6.5, "baseSeverity": "MEDIUM"}}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-9665", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-11-23T01:19:46.807745Z"}}}], "providerMetadata": {"shortName": "CISA-ADP", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "dateUpdated": "2024-11-23T01:19:49.064Z"}, "title": "CISA ADP Vulnrichment"}]}}

{

dataType : CVE_RECORD (string)

dataVersion : 5.1 (string)

cveMetadata : { »

cveId : CVE-2024-9665 (string)

assignerOrgId : 99f1926a-a320-47d8-bbb5-42feb611262e (string)

state : PUBLISHED (string)

assignerShortName : zdi (string)

dateReserved : 2024-10-08T22:22:05.000Z (string)

datePublished : 2024-11-22T21:02:44.953Z (string)

dateUpdated : 2024-11-22T21:02:44.953Z (string)

}

containers : { »

cna : { »

providerMetadata : { »

orgId : 99f1926a-a320-47d8-bbb5-42feb611262e (string)

shortName : zdi (string)

dateUpdated : 2024-11-22T21:02:44.953Z (string)

}

title : Zimbra GraphQL Cross-Site Request Forgery Information Disclosure Vulnerability (string)

descriptions : [ »

0 : { »

lang : en (string)

value : Zimbra GraphQL Cross-Site Request Forgery Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Zimbra. User interaction is required to exploit this vulnerability in that the target must open a malicious email message. The specific flaw exists within the implementation of the graphql endpoint. The issue results from the lack of proper protections against cross-site request forgery (CSRF) attacks. An attacker can leverage this vulnerability to disclose information in the context of the target email account. Was ZDI-CAN-23939. (string)

}

]

affected : [ »

0 : { »

vendor : Zimbra (string)

product : Zimbra (string)

versions : [ »

0 : { »

version : 10.0.8 (string)

status : affected (string)

}

]

defaultStatus : unknown (string)

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

lang : en (string)

cweId : CWE-352 (string)

description : CWE-352: Cross-Site Request Forgery (CSRF) (string)

type : CWE (string)

}

]

}

]

references : [ »

0 : { »

url : https://www.zerodayinitiative.com/advisories/ZDI-24-1369/ (string)

name : ZDI-24-1369 (string)

tags : [ »

0 : x_research-advisory (string)

]

}

1 : { »

url : https://blog.zimbra.com/2024/10/new-patch-release-reminders-for-missing-attachments-out-of-office-notifications-traffic-light-protocol-tlp-and-mailto-links/ (string)

name : vendor-provided URL (string)

tags : [ »

0 : vendor-advisory (string)

]

}

]

dateAssigned : 2024-10-08T17:22:05.123-05:00 (string)

datePublic : 2024-10-11T17:03:24.864-05:00 (string)

source : { »

lang : en (string)

value : Anonymous (string)

}

metrics : [ »

0 : { »

format : CVSS (string)

cvssV3_0 : { »

version : 3.0 (string)

vectorString : CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N (string)

baseScore : 6.5 (number)

baseSeverity : MEDIUM (string)

}

]

}

adp : [ »

0 : { »

metrics : [ »

0 : { »

other : { »

type : ssvc (string)

content : { »

id : CVE-2024-9665 (string)

role : CISA Coordinator (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : partial (string)

}

]

version : 2.0.3 (string)

timestamp : 2024-11-23T01:19:46.807745Z (string)

}

]

providerMetadata : { »

shortName : CISA-ADP (string)

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

dateUpdated : 2024-11-23T01:19:49.064Z (string)

}

title : CISA ADP Vulnrichment (string)

}

]

}

Show plain JSON

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:zimbra:zimbra:*:*:*:*:*:*:*:*", "matchCriteriaId": "C47C7E67-6EA3-44B6-BEBF-40ECEFB79E5F", "versionEndExcluding": "9.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:zimbra:zimbra:*:*:*:*:*:*:*:*", "matchCriteriaId": "41231D6B-A378-4370-8F58-756F0CCE4063", "versionEndExcluding": "10.0.10", "versionStartIncluding": "10.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:zimbra:zimbra:*:*:*:*:*:*:*:*", "matchCriteriaId": "59CCEE82-EC97-4519-9890-A41A78DF6BF1", "versionEndExcluding": "10.1.2", "versionStartIncluding": "10.1.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:zimbra:zimbra:9.0.0:p0:*:*:*:*:*:*", "matchCriteriaId": "631ADC21-06BA-476D-B134-E25D06740019", "vulnerable": true}, {"criteria": "cpe:2.3:a:zimbra:zimbra:9.0.0:p19:*:*:*:*:*:*", "matchCriteriaId": "92C99D34-300D-4AC6-9D75-538621978E38", "vulnerable": true}, {"criteria": "cpe:2.3:a:zimbra:zimbra:9.0.0:p23:*:*:*:*:*:*", "matchCriteriaId": "D949B9A3-4E4F-45FC-93AB-478B77C6F7AE", "vulnerable": true}, {"criteria": "cpe:2.3:a:zimbra:zimbra:9.0.0:p25:*:*:*:*:*:*", "matchCriteriaId": "0BDA3621-F2AA-4E55-8641-A30B9A3DCF8E", "vulnerable": true}, {"criteria": "cpe:2.3:a:zimbra:zimbra:9.0.0:p26:*:*:*:*:*:*", "matchCriteriaId": "3A29151F-9083-45B7-8C1E-A844372C01C0", "vulnerable": true}, {"criteria": "cpe:2.3:a:zimbra:zimbra:9.0.0:p27:*:*:*:*:*:*", "matchCriteriaId": "E35B7C01-F288-47D6-8C43-50FC6F6FEA7A", "vulnerable": true}, {"criteria": "cpe:2.3:a:zimbra:zimbra:9.0.0:p28:*:*:*:*:*:*", "matchCriteriaId": "40687633-0902-4D3E-8C7B-AE9318EB9DAD", "vulnerable": true}, {"criteria": "cpe:2.3:a:zimbra:zimbra:9.0.0:p30:*:*:*:*:*:*", "matchCriteriaId": "8091130D-23B8-4271-9164-2279C14CBE7B", "vulnerable": true}, {"criteria": "cpe:2.3:a:zimbra:zimbra:9.0.0:p31:*:*:*:*:*:*", "matchCriteriaId": "B40F5F01-E7DC-4399-8F9E-2341069FD555", "vulnerable": true}, {"criteria": "cpe:2.3:a:zimbra:zimbra:9.0.0:p33:*:*:*:*:*:*", "matchCriteriaId": "C8B3E761-6A2D-4AC1-8B46-B04196135A51", "vulnerable": true}, {"criteria": "cpe:2.3:a:zimbra:zimbra:9.0.0:p34:*:*:*:*:*:*", "matchCriteriaId": "EB9B3E42-A399-4F96-ABAD-F21CF48AFF30", "vulnerable": true}, {"criteria": "cpe:2.3:a:zimbra:zimbra:9.0.0:p35:*:*:*:*:*:*", "matchCriteriaId": "E9AF56CC-E13D-46EA-BDF3-95417FEA4A32", "vulnerable": true}, {"criteria": "cpe:2.3:a:zimbra:zimbra:9.0.0:p36:*:*:*:*:*:*", "matchCriteriaId": "F77F73B1-F4B0-416C-8411-B889E908E357", "vulnerable": true}, {"criteria": "cpe:2.3:a:zimbra:zimbra:9.0.0:p37:*:*:*:*:*:*", "matchCriteriaId": "2C4EB21D-AD23-471E-BCC1-F132E419DB4C", "vulnerable": true}, {"criteria": "cpe:2.3:a:zimbra:zimbra:9.0.0:p38:*:*:*:*:*:*", "matchCriteriaId": "29D07F52-8E7B-444F-892A-A027A5E17650", "vulnerable": true}, {"criteria": "cpe:2.3:a:zimbra:zimbra:9.0.0:p39:*:*:*:*:*:*", "matchCriteriaId": "1FB6A28B-F881-403C-B89C-A0667603F6E1", "vulnerable": true}, {"criteria": "cpe:2.3:a:zimbra:zimbra:9.0.0:p4:*:*:*:*:*:*", "matchCriteriaId": "8A3B019E-A357-4F7E-8DB5-336B3209D130", "vulnerable": true}, {"criteria": "cpe:2.3:a:zimbra:zimbra:9.0.0:p40:*:*:*:*:*:*", "matchCriteriaId": "6CF47F57-2BE7-44A7-949E-85861EBC4AA3", "vulnerable": true}, {"criteria": "cpe:2.3:a:zimbra:zimbra:9.0.0:p41:*:*:*:*:*:*", "matchCriteriaId": "88E3601D-9029-44B8-93CB-4603885B21BD", "vulnerable": true}, {"criteria": "cpe:2.3:a:zimbra:zimbra:9.0.0:p7:*:*:*:*:*:*", "matchCriteriaId": "E88525DC-A672-40E8-A756-43DD3E9685CC", "vulnerable": true}, {"criteria": "cpe:2.3:a:zimbra:zimbra:9.0.0:p7.1:*:*:*:*:*:*", "matchCriteriaId": "482EC153-BE0F-4B8B-8AC0-0D2CC3A94752", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Zimbra GraphQL Cross-Site Request Forgery Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Zimbra. User interaction is required to exploit this vulnerability in that the target must open a malicious email message.\n\nThe specific flaw exists within the implementation of the graphql endpoint. The issue results from the lack of proper protections against cross-site request forgery (CSRF) attacks. An attacker can leverage this vulnerability to disclose information in the context of the target email account. Was ZDI-CAN-23939."}, {"lang": "es", "value": "Vulnerabilidad de divulgaci\u00f3n de informaci\u00f3n mediante Cross-Site Request Forgery en Zimbra GraphQL. Esta vulnerabilidad permite a atacantes remotos divulgar informaci\u00f3n confidencial sobre las instalaciones afectadas de Zimbra. Se requiere la interacci\u00f3n del usuario para explotar esta vulnerabilidad, ya que el objetivo debe abrir un mensaje de correo electr\u00f3nico malicioso. La falla espec\u00edfica existe dentro de la implementaci\u00f3n del endpoint GraphQL. El problema es el resultado de la falta de protecciones adecuadas contra ataques de Cross-Site Request Forgery (CSRF). Un atacante puede aprovechar esta vulnerabilidad para divulgar informaci\u00f3n en el contexto de la cuenta de correo electr\u00f3nico de destino. Era ZDI-CAN-23939."}], "id": "CVE-2024-9665", "lastModified": "2025-01-03T21:58:29.893", "metrics": {"cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.0"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "zdi-disclosures@trendmicro.com", "type": "Secondary"}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2024-11-22T21:15:23.923", "references": [{"source": "zdi-disclosures@trendmicro.com", "tags": ["Release Notes"], "url": "https://blog.zimbra.com/2024/10/new-patch-release-reminders-for-missing-attachments-out-of-office-notifications-traffic-light-protocol-tlp-and-mailto-links/"}, {"source": "zdi-disclosures@trendmicro.com", "tags": ["Third Party Advisory"], "url": "https://www.zerodayinitiative.com/advisories/ZDI-24-1369/"}], "sourceIdentifier": "zdi-disclosures@trendmicro.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}], "source": "zdi-disclosures@trendmicro.com", "type": "Primary"}]}

{

configurations : [ »

0 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:a:zimbra:zimbra:*:*:*:*:*:*:*:* (string)

matchCriteriaId : C47C7E67-6EA3-44B6-BEBF-40ECEFB79E5F (string)

versionEndExcluding : 9.0.0 (string)

vulnerable : true (boolean)

}

1 : { »

criteria : cpe:2.3:a:zimbra:zimbra:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 41231D6B-A378-4370-8F58-756F0CCE4063 (string)

versionEndExcluding : 10.0.10 (string)

versionStartIncluding : 10.0.0 (string)

vulnerable : true (boolean)

}

2 : { »

criteria : cpe:2.3:a:zimbra:zimbra:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 59CCEE82-EC97-4519-9890-A41A78DF6BF1 (string)

versionEndExcluding : 10.1.2 (string)

versionStartIncluding : 10.1.0 (string)

vulnerable : true (boolean)

}

3 : { »

criteria : cpe:2.3:a:zimbra:zimbra:9.0.0:p0:*:*:*:*:*:* (string)

matchCriteriaId : 631ADC21-06BA-476D-B134-E25D06740019 (string)

vulnerable : true (boolean)

}

4 : { »

criteria : cpe:2.3:a:zimbra:zimbra:9.0.0:p19:*:*:*:*:*:* (string)

matchCriteriaId : 92C99D34-300D-4AC6-9D75-538621978E38 (string)

vulnerable : true (boolean)

}

5 : { »

criteria : cpe:2.3:a:zimbra:zimbra:9.0.0:p23:*:*:*:*:*:* (string)

matchCriteriaId : D949B9A3-4E4F-45FC-93AB-478B77C6F7AE (string)

vulnerable : true (boolean)

}

6 : { »

criteria : cpe:2.3:a:zimbra:zimbra:9.0.0:p25:*:*:*:*:*:* (string)

matchCriteriaId : 0BDA3621-F2AA-4E55-8641-A30B9A3DCF8E (string)

vulnerable : true (boolean)

}

7 : { »

criteria : cpe:2.3:a:zimbra:zimbra:9.0.0:p26:*:*:*:*:*:* (string)

matchCriteriaId : 3A29151F-9083-45B7-8C1E-A844372C01C0 (string)

vulnerable : true (boolean)

}

8 : { »

criteria : cpe:2.3:a:zimbra:zimbra:9.0.0:p27:*:*:*:*:*:* (string)

matchCriteriaId : E35B7C01-F288-47D6-8C43-50FC6F6FEA7A (string)

vulnerable : true (boolean)

}

9 : { »

criteria : cpe:2.3:a:zimbra:zimbra:9.0.0:p28:*:*:*:*:*:* (string)

matchCriteriaId : 40687633-0902-4D3E-8C7B-AE9318EB9DAD (string)

vulnerable : true (boolean)

}

10 : { »

criteria : cpe:2.3:a:zimbra:zimbra:9.0.0:p30:*:*:*:*:*:* (string)

matchCriteriaId : 8091130D-23B8-4271-9164-2279C14CBE7B (string)

vulnerable : true (boolean)

}

11 : { »

criteria : cpe:2.3:a:zimbra:zimbra:9.0.0:p31:*:*:*:*:*:* (string)

matchCriteriaId : B40F5F01-E7DC-4399-8F9E-2341069FD555 (string)

vulnerable : true (boolean)

}

12 : { »

criteria : cpe:2.3:a:zimbra:zimbra:9.0.0:p33:*:*:*:*:*:* (string)

matchCriteriaId : C8B3E761-6A2D-4AC1-8B46-B04196135A51 (string)

vulnerable : true (boolean)

}

13 : { »

criteria : cpe:2.3:a:zimbra:zimbra:9.0.0:p34:*:*:*:*:*:* (string)

matchCriteriaId : EB9B3E42-A399-4F96-ABAD-F21CF48AFF30 (string)

vulnerable : true (boolean)

}

14 : { »

criteria : cpe:2.3:a:zimbra:zimbra:9.0.0:p35:*:*:*:*:*:* (string)

matchCriteriaId : E9AF56CC-E13D-46EA-BDF3-95417FEA4A32 (string)

vulnerable : true (boolean)

}

15 : { »

criteria : cpe:2.3:a:zimbra:zimbra:9.0.0:p36:*:*:*:*:*:* (string)

matchCriteriaId : F77F73B1-F4B0-416C-8411-B889E908E357 (string)

vulnerable : true (boolean)

}

16 : { »

criteria : cpe:2.3:a:zimbra:zimbra:9.0.0:p37:*:*:*:*:*:* (string)

matchCriteriaId : 2C4EB21D-AD23-471E-BCC1-F132E419DB4C (string)

vulnerable : true (boolean)

}

17 : { »

criteria : cpe:2.3:a:zimbra:zimbra:9.0.0:p38:*:*:*:*:*:* (string)

matchCriteriaId : 29D07F52-8E7B-444F-892A-A027A5E17650 (string)

vulnerable : true (boolean)

}

18 : { »

criteria : cpe:2.3:a:zimbra:zimbra:9.0.0:p39:*:*:*:*:*:* (string)

matchCriteriaId : 1FB6A28B-F881-403C-B89C-A0667603F6E1 (string)

vulnerable : true (boolean)

}

19 : { »

criteria : cpe:2.3:a:zimbra:zimbra:9.0.0:p4:*:*:*:*:*:* (string)

matchCriteriaId : 8A3B019E-A357-4F7E-8DB5-336B3209D130 (string)

vulnerable : true (boolean)

}

20 : { »

criteria : cpe:2.3:a:zimbra:zimbra:9.0.0:p40:*:*:*:*:*:* (string)

matchCriteriaId : 6CF47F57-2BE7-44A7-949E-85861EBC4AA3 (string)

vulnerable : true (boolean)

}

21 : { »

criteria : cpe:2.3:a:zimbra:zimbra:9.0.0:p41:*:*:*:*:*:* (string)

matchCriteriaId : 88E3601D-9029-44B8-93CB-4603885B21BD (string)

vulnerable : true (boolean)

}

22 : { »

criteria : cpe:2.3:a:zimbra:zimbra:9.0.0:p7:*:*:*:*:*:* (string)

matchCriteriaId : E88525DC-A672-40E8-A756-43DD3E9685CC (string)

vulnerable : true (boolean)

}

23 : { »

criteria : cpe:2.3:a:zimbra:zimbra:9.0.0:p7.1:*:*:*:*:*:* (string)

matchCriteriaId : 482EC153-BE0F-4B8B-8AC0-0D2CC3A94752 (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

}

]

cveTags : [ *empty* ]

descriptions : [ »

0 : { »

lang : en (string)

value : Zimbra GraphQL Cross-Site Request Forgery Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Zimbra. User interaction is required to exploit this vulnerability in that the target must open a malicious email message. The specific flaw exists within the implementation of the graphql endpoint. The issue results from the lack of proper protections against cross-site request forgery (CSRF) attacks. An attacker can leverage this vulnerability to disclose information in the context of the target email account. Was ZDI-CAN-23939. (string)

}

1 : { »

lang : es (string)

value : Vulnerabilidad de divulgación de información mediante Cross-Site Request Forgery en Zimbra GraphQL. Esta vulnerabilidad permite a atacantes remotos divulgar información confidencial sobre las instalaciones afectadas de Zimbra. Se requiere la interacción del usuario para explotar esta vulnerabilidad, ya que el objetivo debe abrir un mensaje de correo electrónico malicioso. La falla específica existe dentro de la implementación del endpoint GraphQL. El problema es el resultado de la falta de protecciones adecuadas contra ataques de Cross-Site Request Forgery (CSRF). Un atacante puede aprovechar esta vulnerabilidad para divulgar información en el contexto de la cuenta de correo electrónico de destino. Era ZDI-CAN-23939. (string)

}

]

id : CVE-2024-9665 (string)

lastModified : 2025-01-03T21:58:29.893 (string)

metrics : { »

cvssMetricV30 : [ »

0 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : NONE (string)

baseScore : 6.5 (number)

baseSeverity : MEDIUM (string)

confidentialityImpact : HIGH (string)

integrityImpact : NONE (string)

privilegesRequired : NONE (string)

scope : UNCHANGED (string)

userInteraction : REQUIRED (string)

vectorString : CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N (string)

version : 3.0 (string)

}

exploitabilityScore : 2.8 (number)

impactScore : 3.6 (number)

source : zdi-disclosures@trendmicro.com (string)

type : Secondary (string)

}

]

cvssMetricV31 : [ »

0 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : NONE (string)

baseScore : 6.5 (number)

baseSeverity : MEDIUM (string)

confidentialityImpact : HIGH (string)

integrityImpact : NONE (string)

privilegesRequired : NONE (string)

scope : UNCHANGED (string)

userInteraction : REQUIRED (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N (string)

version : 3.1 (string)

}

exploitabilityScore : 2.8 (number)

impactScore : 3.6 (number)

source : nvd@nist.gov (string)

type : Primary (string)

}

]

}

published : 2024-11-22T21:15:23.923 (string)

references : [ »

0 : { »

source : zdi-disclosures@trendmicro.com (string)

tags : [ »

0 : Release Notes (string)

]

url : https://blog.zimbra.com/2024/10/new-patch-release-reminders-for-missing-attachments-out-of-office-notifications-traffic-light-protocol-tlp-and-mailto-links/ (string)

}

1 : { »

source : zdi-disclosures@trendmicro.com (string)

tags : [ »

0 : Third Party Advisory (string)

]

url : https://www.zerodayinitiative.com/advisories/ZDI-24-1369/ (string)

}

]

sourceIdentifier : zdi-disclosures@trendmicro.com (string)

vulnStatus : Analyzed (string)

weaknesses : [ »

0 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-352 (string)

}

]

source : zdi-disclosures@trendmicro.com (string)

type : Primary (string)

}

]

}

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction Required

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction Required

Exploitation none

Automatable no

Technical Impact partial

Affected Vendors & Products

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction Required

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction Required

Exploitation none

Automatable no

Technical Impact partial

Affected Vendors & Products

JSON object

JSON object

JSON object

JSON object