CVE-2017-6080: Cross-Site Request Forgery (CSRF)

An issue was discovered in Zammad before 1.0.4, 1.1.x before 1.1.3, and 1.2.x before 1.2.1, caused by lack of a protection mechanism involving HTTP Access-Control headers. To exploit the vulnerability, an attacker can send cross-domain requests directly to the REST API for users with a valid...

CVE-2017-5620: Improper Neutralization of Input During Web Page Generation

An XSS issue was discovered in Zammad before 1.0.4, 1.1.x before 1.1.3, and 1.2.x before 1.2.1. Attachments are opened in a new tab instead of getting downloaded. This creates an attack vector of executing code in the domain of the application...

CVE-2017-5621: Improper Neutralization of Input During Web Page Generation

An issue was discovered in Zammad before 1.0.4, 1.1.x before 1.1.3, and 1.2.x before 1.2.1. XSS can be triggered via malicious HTML in a chat message or the content of a ticket article, when using either the REST API or the WebSocket API...

CVE-2017-5619: Improper Authentication

An issue was discovered in Zammad before 1.0.4, 1.1.x before 1.1.3, and 1.2.x before 1.2.1. Attackers can login with the hashed password itself e.g., from the DB instead of the valid password string...

PT-2017-16624

Name of the Vulnerable Software and Affected Versions Zammad versions prior to 1.0.4 Zammad versions 1.1.x prior to 1.1.3 Zammad versions 1.2.x prior to 1.2.1 Description A cross-site scripting XSS issue was found. The problem arises because attachments are opened in a new tab instead of being...

PT-2017-16625

Name of the Vulnerable Software and Affected Versions Zammad versions prior to 1.0.4 Zammad versions 1.1.x prior to 1.1.3 Zammad versions 1.2.x prior to 1.2.1 Description An issue allows XSS to be triggered via malicious HTML in a chat message or the content of a ticket article, when using either...

PT-2017-16884

Name of the Vulnerable Software and Affected Versions Zammad versions prior to 1.0.4 Zammad versions 1.1.x prior to 1.1.3 Zammad versions 1.2.x prior to 1.2.1 Description A CSRF issue was discovered. To exploit the issue, an attacker can send cross-domain requests directly to the REST API for use...

PT-2017-16623

Name of the Vulnerable Software and Affected Versions Zammad versions prior to 1.0.4 Zammad versions 1.1.x prior to 1.1.3 Zammad versions 1.2.x prior to 1.2.1 Description An issue allows attackers to login using the hashed password itself, such as from the database, instead of the valid password...

PT-2017-16883

Name of the Vulnerable Software and Affected Versions Zammad versions prior to 1.0.4 Zammad versions 1.1.x prior to 1.1.3 Zammad versions 1.2.x prior to 1.2.1 Description The issue is caused by a lack of protection mechanism involving HTTP Access-Control headers. An attacker can exploit this by...