Executive Summary

This vulnerability exists in the EnableTwoFactorAuthRequest SOAP endpoint of Zimbra Collaboration (ZCS). It allows an attacker who already has valid user credentials to bypass the Two-Factor Authentication (2FA) protection by configuring an additional 2FA method without needing a valid authentication token or access to an existing 2FA method. Essentially, the attacker can add a new 2FA method and gain unauthorized access to accounts that should be protected by 2FA.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can lead to unauthorized access to user accounts that are supposed to be protected by Two-Factor Authentication. An attacker with valid credentials can bypass 2FA, potentially compromising sensitive information, performing unauthorized actions, and undermining the security of the affected accounts.

Useful 0 Not Useful 0