CVE-2015-7610

Cross-site request forgery (CSRF) vulnerability in the login form in Zimbra Collaboration Suite (aka ZCS) before 8.6.0 Patch 10, 8.7.x before 8.7.11 Patch 2, and 8.8.x before 8.8.8 Patch 1 allows remote attackers to hijack the authentication of unspecified victims by leveraging failure to use a CSRF token.

• CWE-352

• https://blog.zimbra.com/2018/04/new-patches-for-you-zimbra-8-8-8-turing-patch-1-zimbra-8-7-11-patch-2/Patch, Vendor Advisory
• https://blog.zimbra.com/2018/05/new-patches-zimbra-8-8-8-turing-patch-3-zimbra-8-7-11-patch-3-zimbra-8-6-0-patch-10/Patch, Vendor Advisory
• https://wiki.zimbra.com/wiki/Security_CenterPatch, Vendor Advisory
• https://wiki.zimbra.com/wiki/Zimbra_Releases/8.6.0/P10Patch, Release Notes, Vendor Advisory
• https://wiki.zimbra.com/wiki/Zimbra_Releases/8.7.11/P2Patch, Release Notes, Vendor Advisory
• https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.8/P1Patch, Release Notes, Vendor Advisory
• https://wiki.zimbra.com/wiki/Zimbra_Security_AdvisoriesPatch, Vendor Advisory
• https://blog.zimbra.com/2018/04/new-patches-for-you-zimbra-8-8-8-turing-patch-1-zimbra-8-7-11-patch-2/Patch, Vendor Advisory
• https://blog.zimbra.com/2018/05/new-patches-zimbra-8-8-8-turing-patch-3-zimbra-8-7-11-patch-3-zimbra-8-6-0-patch-10/Patch, Vendor Advisory
• https://wiki.zimbra.com/wiki/Security_CenterPatch, Vendor Advisory
• https://wiki.zimbra.com/wiki/Zimbra_Releases/8.6.0/P10Patch, Release Notes, Vendor Advisory
• https://wiki.zimbra.com/wiki/Zimbra_Releases/8.7.11/P2Patch, Release Notes, Vendor Advisory
• https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.8/P1Patch, Release Notes, Vendor Advisory
• https://wiki.zimbra.com/wiki/Zimbra_Security_AdvisoriesPatch, Vendor Advisory

Published

May 30, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2015-7600Cisco VPN Client 5.x through 5.0.07.0440 uses weak permissio…
• CVE-2015-7601Directory traversal vulnerability in PCMan's FTP Server 2.0.…
• CVE-2015-7602Directory traversal vulnerability in BisonWare BisonFTP 3.5 …
• CVE-2015-7603Directory traversal vulnerability in Konica Minolta FTP Util…
• CVE-2015-7604Cross-site scripting (XSS) vulnerability in Splunk Web in Sp…
• CVE-2015-7609Synacor Zimbra Mail Client 8.6 before 8.6.0 Patch 5 has XSS …
• CVE-2015-7611Apache James Server 2.3.2, when configured with file-based u…
• CVE-2015-7612Multiple cross-site request forgery (CSRF) vulnerabilities i…
• CVE-2015-7613Race condition in the IPC object implementation in the Linux…
• CVE-2015-7614Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before…
• CVE-2015-7615Use-after-free vulnerability in a SaveAs feature in Adobe Re…
• CVE-2015-7616The ANVerifyComments method in Adobe Reader and Acrobat 10.x…