PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-3406 Synacor CVE debrief

CVE-2016-3406 covers multiple cross-site request forgery (CSRF) issues in Zimbra Collaboration before 8.7.0. NVD says remote attackers could hijack the authentication of affected victims through either the Client uploader extension or extension REST handlers. The issue is rated high severity, but it requires user interaction because the attack depends on a victim being induced to process malicious cross-site requests.

Vendor
Synacor
Product
CVE-2016-3406
CVSS
HIGH 8.8
CISA KEV
Not listed in stored evidence
Original CVE published
2017-01-18
Original CVE updated
2026-05-13
Advisory published
2017-01-18
Advisory updated
2026-05-13

Who should care

Administrators and security teams running Zimbra Collaboration versions before 8.7.0 should prioritize this. It is especially relevant for environments where users access Zimbra through browsers and where extension or uploader functionality is enabled.

Technical summary

NVD maps this vulnerability to CWE-352 and lists the affected product as Synacor Zimbra Collaboration Suite up to version 8.6.0, with remediation implied by Zimbra 8.7.0 release materials. The CVSS vector is AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, reflecting network reachability, no privileges required, required user interaction, and high impact if successful. The cited vectors are the Client uploader extension and extension REST handlers, both described as CSRF paths that can lead to authentication hijacking.

Defensive priority

High. The combination of no privileges required, network exposure, and high confidentiality/integrity/availability impact makes this worth urgent patch verification, even though user interaction is required.

Recommended defensive actions

  • Upgrade Zimbra Collaboration to version 8.7.0 or later.
  • Confirm whether any hosts are still on versions before 8.7.0, especially 8.6.0 or earlier.
  • Review exposure of extension and uploader-related functionality in browser-accessed workflows.
  • Validate that users are protected against cross-site request forgery through standard web controls and vendor guidance.
  • Use the vendor security advisories and release notes to confirm the fixed build and any deployment-specific notes.

Evidence notes

Source evidence is limited to the supplied NVD record and linked vendor references. NVD states the vulnerability affects Synacor Zimbra Collaboration Suite versions through 8.6.0 and identifies CWE-352. The record also cites Zimbra bug IDs 104294 and 104456, plus Zimbra 8.7.0 release notes and Zimbra security advisories as relevant references. No exploit code or reproduction details are included here.

Official resources

CVE published by NVD on 2017-01-18 and later modified on 2026-05-13. This debrief uses the CVE publication date for timing context and does not treat publication or modification dates as the underlying vulnerability date.