Read the docs
TI-2015-06316 Aliases CVE-2015-7610GHSA-6f8r-6vw8-h9xj

Cross-site request forgery (CSRF) vulnerability in the login form in Zimbra Collaboration…

Priority MEDIUM 41CWE-352Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Tampering
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-352.

Summary

Cross-site request forgery (CSRF) vulnerability in the login form in Zimbra Collaboration Suite (aka ZCS) before 8.6.0 Patch 10, 8.7.x before 8.7.11 Patch 2, and 8.8.x before 8.8.8 Patch 1 allows remote attackers to hijack the authentication of unspecified victims by leveraging failure to use a CSRF token.

Why it matters now

EPSS 0.01231 69th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 12

CPEVersionsRoleVendor
cpe:2.3:a:synacor:zimbra_collaboration_suite:*:*:*:*:*:*:*:*8.7.0 – 8.7.11; 8.8.0 – 8.8.8VulnerableSynacor
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.6.0:*:*:*:*:*:*:*8.6.0VulnerableSynacor
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.7.11:p1:*:*:*:*:*:*8.7.11 p1VulnerableSynacor
cpe:2.3:a:zimbra:zimbra_collaboration_suite:8.6.0:p1:*:*:*:*:*:*8.6.0 p1VulnerableZimbra
cpe:2.3:a:zimbra:zimbra_collaboration_suite:8.6.0:p2:*:*:*:*:*:*8.6.0 p2VulnerableZimbra
cpe:2.3:a:zimbra:zimbra_collaboration_suite:8.6.0:p3:*:*:*:*:*:*8.6.0 p3VulnerableZimbra
cpe:2.3:a:zimbra:zimbra_collaboration_suite:8.6.0:p4:*:*:*:*:*:*8.6.0 p4VulnerableZimbra
cpe:2.3:a:zimbra:zimbra_collaboration_suite:8.6.0:p5:*:*:*:*:*:*8.6.0 p5VulnerableZimbra
cpe:2.3:a:zimbra:zimbra_collaboration_suite:8.6.0:p6:*:*:*:*:*:*8.6.0 p6VulnerableZimbra
cpe:2.3:a:zimbra:zimbra_collaboration_suite:8.6.0:p7:*:*:*:*:*:*8.6.0 p7VulnerableZimbra
  • cpe:2.3:a:synacor:zimbra_collaboration_suite:*:*:*:*:*:*:*:* Versions 8.7.0 – 8.7.11; 8.8.0 – 8.8.8 Vulnerable ·Synacor
  • cpe:2.3:a:synacor:zimbra_collaboration_suite:8.6.0:*:*:*:*:*:*:* Versions 8.6.0 Vulnerable ·Synacor
  • cpe:2.3:a:synacor:zimbra_collaboration_suite:8.7.11:p1:*:*:*:*:*:* Versions 8.7.11 p1 Vulnerable ·Synacor
  • cpe:2.3:a:zimbra:zimbra_collaboration_suite:8.6.0:p1:*:*:*:*:*:* Versions 8.6.0 p1 Vulnerable ·Zimbra
  • cpe:2.3:a:zimbra:zimbra_collaboration_suite:8.6.0:p2:*:*:*:*:*:* Versions 8.6.0 p2 Vulnerable ·Zimbra
  • cpe:2.3:a:zimbra:zimbra_collaboration_suite:8.6.0:p3:*:*:*:*:*:* Versions 8.6.0 p3 Vulnerable ·Zimbra
  • cpe:2.3:a:zimbra:zimbra_collaboration_suite:8.6.0:p4:*:*:*:*:*:* Versions 8.6.0 p4 Vulnerable ·Zimbra
  • cpe:2.3:a:zimbra:zimbra_collaboration_suite:8.6.0:p5:*:*:*:*:*:* Versions 8.6.0 p5 Vulnerable ·Zimbra
  • cpe:2.3:a:zimbra:zimbra_collaboration_suite:8.6.0:p6:*:*:*:*:*:* Versions 8.6.0 p6 Vulnerable ·Zimbra
  • cpe:2.3:a:zimbra:zimbra_collaboration_suite:8.6.0:p7:*:*:*:*:*:* Versions 8.6.0 p7 Vulnerable ·Zimbra
Show 2 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:zimbra:zimbra_collaboration_suite:8.6.0:p8:*:*:*:*:*:*8.6.0 p8VulnerableZimbra
cpe:2.3:a:zimbra:zimbra_collaboration_suite:8.6.0:p9:*:*:*:*:*:*8.6.0 p9VulnerableZimbra
  • cpe:2.3:a:zimbra:zimbra_collaboration_suite:8.6.0:p8:*:*:*:*:*:* Versions 8.6.0 p8 Vulnerable ·Zimbra
  • cpe:2.3:a:zimbra:zimbra_collaboration_suite:8.6.0:p9:*:*:*:*:*:* Versions 8.6.0 p9 Vulnerable ·Zimbra

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2015-7610
  2. 2026-10-03 Alias added: GHSA-6f8r-6vw8-h9xj

References

Patch 7

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences