6.1

CVE-2021-34807

An open redirect vulnerability exists in the /preauth Servlet in Zimbra Collaboration Suite through 9.0. To exploit the vulnerability, an attacker would need to have obtained a valid zimbra auth token or a valid preauth token. Once the token is obtained, an attacker could redirect a user to any URL via isredirect=1&redirectURL= in conjunction with the token data (e.g., a valid authtoken= value).
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Zimbra ≫ Collaboration Version < 8.8.15
Zimbra ≫ Collaboration Version8.8.15 Update-
Zimbra ≫ Collaboration Version8.8.15 Updatep1
Zimbra ≫ Collaboration Version8.8.15 Updatep10
Zimbra ≫ Collaboration Version8.8.15 Updatep11
Zimbra ≫ Collaboration Version8.8.15 Updatep12
Zimbra ≫ Collaboration Version8.8.15 Updatep13
Zimbra ≫ Collaboration Version8.8.15 Updatep14
Zimbra ≫ Collaboration Version8.8.15 Updatep15
Zimbra ≫ Collaboration Version8.8.15 Updatep16
Zimbra ≫ Collaboration Version8.8.15 Updatep17
Zimbra ≫ Collaboration Version8.8.15 Updatep18
Zimbra ≫ Collaboration Version8.8.15 Updatep19
Zimbra ≫ Collaboration Version8.8.15 Updatep2
Zimbra ≫ Collaboration Version8.8.15 Updatep20
Zimbra ≫ Collaboration Version8.8.15 Updatep21
Zimbra ≫ Collaboration Version8.8.15 Updatep22
Zimbra ≫ Collaboration Version8.8.15 Updatep3
Zimbra ≫ Collaboration Version8.8.15 Updatep4
Zimbra ≫ Collaboration Version8.8.15 Updatep5
Zimbra ≫ Collaboration Version8.8.15 Updatep6
Zimbra ≫ Collaboration Version8.8.15 Updatep7
Zimbra ≫ Collaboration Version8.8.15 Updatep8
Zimbra ≫ Collaboration Version8.8.15 Updatep9
Zimbra ≫ Collaboration Version9.0.0 Update-
Zimbra ≫ Collaboration Version9.0.0 Updatep1
Zimbra ≫ Collaboration Version9.0.0 Updatep10
Zimbra ≫ Collaboration Version9.0.0 Updatep11
Zimbra ≫ Collaboration Version9.0.0 Updatep12
Zimbra ≫ Collaboration Version9.0.0 Updatep13
Zimbra ≫ Collaboration Version9.0.0 Updatep14
Zimbra ≫ Collaboration Version9.0.0 Updatep15
Zimbra ≫ Collaboration Version9.0.0 Updatep2
Zimbra ≫ Collaboration Version9.0.0 Updatep3
Zimbra ≫ Collaboration Version9.0.0 Updatep4
Zimbra ≫ Collaboration Version9.0.0 Updatep5
Zimbra ≫ Collaboration Version9.0.0 Updatep6
Zimbra ≫ Collaboration Version9.0.0 Updatep7
Zimbra ≫ Collaboration Version9.0.0 Updatep8
Zimbra ≫ Collaboration Version9.0.0 Updatep9
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.84% 0.741
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 6.1 2.8 2.7
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
nvd@nist.gov 5.8 8.6 4.9
AV:N/AC:M/Au:N/C:P/I:P/A:N
CWE-601 URL Redirection to Untrusted Site ('Open Redirect')

The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.

https://wiki.zimbra.com/wiki/Security_Center
Vendor Advisory
Release Notes