{"id":70388,"date":"2025-09-17T20:32:02","date_gmt":"2025-09-17T17:02:02","guid":{"rendered":"https:\/\/afaghhosting.net\/blog\/cve-2025-54390-zimbra-collaboration-csrf-password-reset-vulnerability\/"},"modified":"2025-09-17T20:32:02","modified_gmt":"2025-09-17T17:02:02","slug":"cve-2025-54390-zimbra-collaboration-csrf-password-reset-vulnerability","status":"publish","type":"post","link":"https:\/\/afaghhosting.net\/blog\/cve-2025-54390-zimbra-collaboration-csrf-password-reset-vulnerability\/","title":{"rendered":"CVE-2025-54390 &#8211; Zimbra Collaboration CSRF Password Reset Vulnerability"},"content":{"rendered":"<p><strong>CVE ID : <\/strong>CVE-2025-54390<br \/>\n<br \/>\n<strong>Published : <\/strong> Sept. 17, 2025, 3:15 p.m. | 1\u00a0hour, 44\u00a0minutes ago<br \/>\n<br \/>\n<strong>Description : <\/strong>A Cross-Site Request Forgery (CSRF) vulnerability exists in the ResetPasswordRequest operation of Zimbra Collaboration (ZCS) when the zimbraFeatureResetPasswordStatus attribute is enabled. An attacker can exploit this by tricking an authenticated user into visiting a malicious webpage that silently sends a crafted SOAP request to reset the user&#8217;s password. The vulnerability stems from a lack of CSRF token validation on the endpoint, allowing password resets without the user&#8217;s consent.<br \/>\n<br \/>\n<strong>Severity:<\/strong> 6.3 | MEDIUM<br \/>\n<br \/>\nVisit the link for more details, such as CVSS details, affected products, timeline, and more&#8230;<\/p>\n","protected":false},"excerpt":{"rendered":"<p>CVE ID : CVE-2025-54390 Published : Sept. 17, 2025, 3:15 p.m. | 1\u00a0hour, 44\u00a0minutes ago Description : A Cross-Site Request Forgery (CSRF) vulnerability exists in the ResetPasswordRequest operation of Zimbra Collaboration (ZCS) when the zimbraFeatureResetPasswordStatus attribute is enabled. An attacker can exploit this by tricking an authenticated user into visiting a malicious webpage that silently &hellip;<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[26],"tags":[],"class_list":["post-70388","post","type-post","status-publish","format-standard","hentry","category-vulnerability"],"_links":{"self":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/70388","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/comments?post=70388"}],"version-history":[{"count":0,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/70388\/revisions"}],"wp:attachment":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/media?parent=70388"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/categories?post=70388"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/tags?post=70388"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}