CVE-2024-9665

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2024-9665

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-9665.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2024-9665

Published

2024-11-22T21:02:44.953Z

Modified

2026-07-15T02:13:31.287170144Z

Severity

6.5 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N CVSS Calculator

Summary

Zimbra GraphQL Cross-Site Request Forgery Information Disclosure Vulnerability

Details

Zimbra GraphQL Cross-Site Request Forgery Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Zimbra. User interaction is required to exploit this vulnerability in that the target must open a malicious email message.

The specific flaw exists within the implementation of the graphql endpoint. The issue results from the lack of proper protections against cross-site request forgery (CSRF) attacks. An attacker can leverage this vulnerability to disclose information in the context of the target email account. Was ZDI-CAN-23939.

Database specific

{
    "cwe_ids": [
        "CWE-352"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/9xxx/CVE-2024-9665.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "10.0.8"
                },
                {
                    "last_affected": "10.0.8"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ],
    "cna_assigner": "zdi"
}

References

Affected packages

Git / github.com/zimbra/zm-build

Affected ranges

Type

GIT

Repo

https://github.com/zimbra/zm-build

Events

Introduced

Fixed

b6cd8f69d2761c014d4a3807f0bdee0011386444

Introduced

52b539ef205db233bfd8116e8130e27735b4153c

Fixed

c33cd93d74564b2fcd6078b564b2e1b4dc9481d3

Introduced

de2eedbbdb8d58c34aac58dbf3866ae721f039eb

Last affected

b20d016c829af1c0ffbaa0545c1deb96ccd5e2e5

Database specific

{
    "cpe": [
        "cpe:2.3:a:zimbra:zimbra:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:zimbra:zimbra:9.0.0:p0:*:*:*:*:*:*",
        "cpe:2.3:a:zimbra:zimbra:9.0.0:p19:*:*:*:*:*:*",
        "cpe:2.3:a:zimbra:zimbra:9.0.0:p23:*:*:*:*:*:*",
        "cpe:2.3:a:zimbra:zimbra:9.0.0:p25:*:*:*:*:*:*",
        "cpe:2.3:a:zimbra:zimbra:9.0.0:p26:*:*:*:*:*:*",
        "cpe:2.3:a:zimbra:zimbra:9.0.0:p27:*:*:*:*:*:*",
        "cpe:2.3:a:zimbra:zimbra:9.0.0:p28:*:*:*:*:*:*",
        "cpe:2.3:a:zimbra:zimbra:9.0.0:p33:*:*:*:*:*:*",
        "cpe:2.3:a:zimbra:zimbra:9.0.0:p36:*:*:*:*:*:*",
        "cpe:2.3:a:zimbra:zimbra:9.0.0:p37:*:*:*:*:*:*",
        "cpe:2.3:a:zimbra:zimbra:9.0.0:p38:*:*:*:*:*:*",
        "cpe:2.3:a:zimbra:zimbra:9.0.0:p4:*:*:*:*:*:*",
        "cpe:2.3:a:zimbra:zimbra:9.0.0:p7:*:*:*:*:*:*",
        "cpe:2.3:a:zimbra:zimbra:9.0.0:p7.1:*:*:*:*:*:*"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "9.0.0"
        },
        {
            "introduced": "10.1.0"
        },
        {
            "fixed": "10.1.2"
        },
        {
            "introduced": "9.0.0-p0"
        },
        {
            "last_affected": "9.0.0-p0"
        },
        {
            "introduced": "9.0.0-p19"
        },
        {
            "last_affected": "9.0.0-p19"
        },
        {
            "introduced": "9.0.0-p23"
        },
        {
            "last_affected": "9.0.0-p23"
        },
        {
            "introduced": "9.0.0-p25"
        },
        {
            "last_affected": "9.0.0-p25"
        },
        {
            "introduced": "9.0.0-p26"
        },
        {
            "last_affected": "9.0.0-p26"
        },
        {
            "introduced": "9.0.0-p27"
        },
        {
            "last_affected": "9.0.0-p27"
        },
        {
            "introduced": "9.0.0-p28"
        },
        {
            "last_affected": "9.0.0-p28"
        },
        {
            "introduced": "9.0.0-p33"
        },
        {
            "last_affected": "9.0.0-p33"
        },
        {
            "introduced": "9.0.0-p36"
        },
        {
            "last_affected": "9.0.0-p36"
        },
        {
            "introduced": "9.0.0-p37"
        },
        {
            "last_affected": "9.0.0-p37"
        },
        {
            "introduced": "9.0.0-p38"
        },
        {
            "last_affected": "9.0.0-p38"
        },
        {
            "introduced": "9.0.0-p4"
        },
        {
            "last_affected": "9.0.0-p4"
        },
        {
            "introduced": "9.0.0-p7"
        },
        {
            "last_affected": "9.0.0-p7"
        },
        {
            "introduced": "9.0.0-p7\\.1"
        },
        {
            "last_affected": "9.0.0-p7\\.1"
        }
    ],
    "source": [
        "CPE_RANGE",
        "CPE_STRING"
    ]
}

Affected versions

10.*

10.1.0

10.1.1

10.1.10

10.1.13

10.1.14

10.1.16

10.1.4

10.1.5

10.1.6

8.*

8.7.10

8.7.11

8.7.6

8.7.7

8.7.9

8.8.0.beta1

8.8.10

8.8.12

8.8.2

8.8.3

8.8.4

8.8.6

8.8.7

8.8.8

8.8.9

8.8.9.p1

8.8.9.p3

9.*

9.0.0

9.0.0-p0

9.0.0-p19

9.0.0-p23

9.0.0-p25

9.0.0-p26

9.0.0-p27

9.0.0-p28

9.0.0-p33

9.0.0-p36

9.0.0-p37

9.0.0-p38

9.0.0-p4

9.0.0-p7

9.0.0-p7\.1

9.0.0.p4

9.0.0.p7

9.0.0.p7.1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-9665.json"