CVE-2021-34807

An open redirect vulnerability exists in the /preauth Servlet in Zimbra Collaboration Suite through 9.0. To exploit the vulnerability, an attacker would need to have obtained a valid zimbra auth token or a valid preauth token. Once the token is obtained, an attacker could redirect a user to any URL via isredirect=1&redirectURL= in conjunction with the token data (e.g., a valid authtoken= value).

• CWE-601

• https://wiki.zimbra.com/wiki/Security_CenterRelease Notes, Vendor Advisory
• https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.15/P23Release Notes, Vendor Advisory
• https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P16Release Notes, Vendor Advisory
• https://wiki.zimbra.com/wiki/Zimbra_Security_AdvisoriesVendor Advisory
• https://wiki.zimbra.com/wiki/Security_CenterRelease Notes, Vendor Advisory
• https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.15/P23Release Notes, Vendor Advisory
• https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P16Release Notes, Vendor Advisory
• https://wiki.zimbra.com/wiki/Zimbra_Security_AdvisoriesVendor Advisory

Published

Jul 2, 2021

Last Modified

Jun 17, 2026

Status

Modified

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-3480A flaw was found in slapi-nis in versions before 0.56.7. A N…7.5
• CVE-2021-34800Sensitive information could be logged. The following product…7.5
• CVE-2021-34801Valine 1.4.14 allows remote attackers to cause a denial of s…5.3
• CVE-2021-34802A failure in resetting the security context in some transact…8.8
• CVE-2021-34803TeamViewer before 14.7.48644 on Windows loads untrusted DLLs…7.8
• CVE-2021-34805An issue was discovered in FAUST iServer before 9.0.019.019.…7.5
• CVE-2021-34808Server-Side Request Forgery (SSRF) vulnerability in cgi comp…5.3
• CVE-2021-34809Improper neutralization of special elements used in a comman…8.8
• CVE-2021-3481A flaw was found in Qt. An out-of-bounds read vulnerability …7.1
• CVE-2021-34810Improper privilege management vulnerability in cgi component…8.8
• CVE-2021-34811Server-Side Request Forgery (SSRF) vulnerability in task man…4.3
• CVE-2021-34812Use of hard-coded credentials vulnerability in php component…7.5