Security Advisory

CVE-2025-54390

CVE vulnerability detail — eXtreme Datacenter Security Operations

Published 2025-09-17 00:00:00

Last updated 2025-09-17 15:03:02

Assigner mitre

State PUBLISHED

Description

A Cross-Site Request Forgery (CSRF) vulnerability exists in the ResetPasswordRequest operation of Zimbra Collaboration (ZCS) when the zimbraFeatureResetPasswordStatus attribute is enabled. An attacker can exploit this by tricking an authenticated user into visiting a malicious webpage that silently sends a crafted SOAP request to reset the users password. The vulnerability stems from a lack of CSRF token validation on the endpoint, allowing password resets without the users consent.

← Browse all CVEs View on cve.org ↗