CVE-2022-35489

In Zammad 5.2.0, customers who have secondary organizations assigned were able to see all organizations of the system rather than only those to which they are assigned...

CVE-2022-35489

CVE-2022-35489 affects Zammad 5.2.0 where users assigned to secondary organizations could view all organizations in the system instead of only their own. The vulnerability arises from insufficient access control for organization visibility, resulting in a High confidentiality impact (C:H) with no...

CVE-2022-35489

In Zammad 5.2.0, customers who have secondary organizations assigned were able to see all organizations of the system rather than only those to which they are assigned...

CVE-2022-35488

In Zammad 5.2.0, an attacker could manipulate the rate limiting in the 'forgot password' feature of Zammad, and thereby send many requests for a known account to cause Denial Of Service by many generated emails which would also spam the victim...

CVE-2022-35488

In Zammad 5.2.0, an attacker could manipulate the rate limiting in the 'forgot password' feature of Zammad, and thereby send many requests for a known account to cause Denial Of Service by many generated emails which would also spam the victim...

CVE-2022-35488

CVE-2022-35488 affects Zammad 5.2.0. The vulnerability stems from insufficient rate-limiting in the forgot-password flow, allowing an attacker to generate many requests for a known account and trigger mass-email delivery, resulting in Denial of Service and potential user spam. Red Hat and CVE rec...

CVE-2022-35487

Zammad 5.2.0 suffers from Incorrect Access Control. Zammad did not correctly perform authorization on certain attachment endpoints. This could be abused by an unauthenticated attacker to gain access to attachments, such as emails or attached files...

CVE-2022-35487

CVE-2022-35487 affects Zammad 5.2.0 with an Incorrect Access Control bug: authorization on certain attachment endpoints is not performed correctly, allowing an unauthenticated attacker to access attachments (e.g., emails or attached files). The NVD entry reports a CVSS v3.1 base score of 7.5 (HIG...

CVE-2022-35487

Zammad 5.2.0 suffers from Incorrect Access Control. Zammad did not correctly perform authorization on certain attachment endpoints. This could be abused by an unauthenticated attacker to gain access to attachments, such as emails or attached files...

Zammad 资源管理错误漏洞

Zammad is a ticket management software from the German company Zammad. A security vulnerability exists in Zammad version 5.2.0, which stems from the "Forgot Password" feature that does not limit the rate of requests, which allows an attacker to send many requests to a victim, generating too many...

Zammad 安全漏洞

Zammad is a suite of ticket management software from the German company Zammad. A security vulnerability exists in Zammad version 5.2.0, which stems from its lack of proper access control and enforcement of authorization for certain attachment endpoints resulting in an unauthenticated attacker...

PT-2022-22863 · Zammad · Zammad

Name of the Vulnerable Software and Affected Versions: Zammad version 5.2.0 Description: The issue is related to Incorrect Access Control in Zammad, where the software did not correctly perform authorization on certain attachment endpoints. This could be exploited by an unauthenticated attacker t...

PT-2022-22867 · Zammad · Zammad

Name of the Vulnerable Software and Affected Versions: Zammad version 5.2.0 Description: The issue allows for privilege escalation. Zammad has a mechanism to prevent brute-force attacks by invalidating users after a configurable number of attempts to guess login credentials. However, an attacker...

Zammad 安全漏洞

Zammad is a suite of ticket management software from the German company Zammad. A security vulnerability exists in Zammad version 5.2.0, which stems from a flaw in its login credentials brute force feature that causes an attacker to bypass the feature's limitations before attempting a certain...

Zammad 安全漏洞

Zammad is a suite of ticket management software from the German company Zammad. A security vulnerability exists in Zammad version 5.2.0 that stems from the ability of a user assigned to a secondary organization to see the entire organization instead of just the organization to which they are...

Zammad's Misconfigured Rack_Attack.rb Does Not Appropriately Protect Against Brute Force Attacks

Description Zammad relies on the rackattack.rb file to defend the application against various brute force attacks, including forgotten password requests, ticket submissions, etc. The currently utilized RackAttack.rb file's configuration attempts to prevent password reset requests per IP to 3 per...

Zammad Access Control Error Vulnerability (CNVD-2022-38759)

A security vulnerability exists in Zammad, a suite of ticket management software from the German company Zammad, which stems from an administrative configuration that broadcasts settings that should only be visible to authenticated users to all users with an active application instance. No detail...

Zammad Denial of Service Vulnerability (CNVD-2022-70097)

Zammad is a suite of ticket management software from Zammad Germany. v5.1.0 of Zammad suffers from a denial of service vulnerability that stems from a lack of a password length limit allowing the creation of extremely long passwords, which could be exploited by an attacker to cause a denial of...

Zammad Denial of Service Vulnerability (CNVD-2022-70098)

Zammad is a suite of ticket management software from Zammad Germany. v5.1.0 of Zammad suffers from a denial of service vulnerability that stems from a lack of rate limiting in the forgot password feature, which could be exploited by an attacker to potentially cause a denial of service DoS via a...

CVE-2022-29701

A lack of rate limiting in the 'forgot password' feature of Zammad v5.1.0 allows attackers to send an excessive amount of reset requests for a legitimate user, leading to a possible Denial of Service DoS via a large amount of generated e-mail messages...