Upon a vulnerability scan, it is requested to fix the above issue on Zimbra Server (8.8.7_GA_1964.RHEL7_64_20180223145016 RHEL7_64 FOSS edition). Please refer the details below.
Sensitive information is exposed in transit between the client and the server via URL query string
parameters. URLs may be stored or viewed in multiple places during and after a request is made
to the server:
• If the URL is requested by clicking a link or manually entering the address, the query string
can be seen in the browser address bar
• URLs are often logged in multiple places including the browser history, proxy logs, and
web server logs
• The query string will be sent as part of the URL if the URL is passed to another site via the
• URLs sent to the user as part of an HTML page may be cached on disk
An attacker who gains access to any location where URLs are stored will be able to view sensitive
information passed via the query string. Depending on the nature of the information, a malicious
user may obtain personally identifiable information (PII), private user data or information which
would allow user impersonation (in the event of credential or session identifier exposure).
Potential access vectors may include but are not limited to:
• Browser history, proxy logs, web server logs, etc.
• Utilizing other attacks (such as cross-site scripting) to extract sensitive information from
the source of a page containing links to URLs with sensitive information in the query string
• Shoulder-surfing the URL in a user's browser address bar
Sensitive information should be passed between the client and server via POST parameters and
not in any portion of the URL.
Any solution to this issue is highly appreciated.
- Zimbra Collaboration 8.6 Patch 9 now available (includes fix for CVE-2017-8802). Read the announcement.
- Zimbra Collaboration 8.8.7 + Zimbra Connector for Outlook 8.8.7 are available.. Read the announcement.
- Are you a Zimbra Developer? You can find some interesting stuff in our Official GitHub: https://github.com/Zimbra and check the Community Projects too: https://github.com/Zimbra-Community/
Discuss your pilot or production implementation with other Zimbra admins or our engineers.
1 post • Page 1 of 1
Who is online
Users browsing this forum: No registered users and 11 guests