PT-2022-18378

Name of the Vulnerable Software and Affected Versions Zammad version 5.0.3 Description An access control issue broadcasts administrative configuration changes to all users who have an active application instance, including settings that should only be visible to authenticated users. Recommendatio...

PT-2022-19790

Name of the Vulnerable Software and Affected Versions Zammad version 5.1.0 Description A lack of rate limiting in the 'forgot password' feature allows attackers to send an excessive amount of reset requests for a legitimate user, leading to a possible Denial of Service DoS via a large amount of...

PT-2022-19789

Name of the Vulnerable Software and Affected Versions Zammad version 5.1.0 Description The issue is related to a lack of password length restriction, allowing the creation of extremely long passwords. This can cause a Denial of Service DoS during password verification. Recommendations For Zammad...

CVE-2022-29700: Weak Password Requirements

A lack of password length restriction in Zammad v5.1.0 allows for the creation of extremely long passwords which can cause a Denial of Service DoS during password verification...

CVE-2022-29701: Allocation of Resources Without Limits or Throttling

A lack of rate limiting in the 'forgot password' feature of Zammad v5.1.0 allows attackers to send an excessive amount of reset requests for a legitimate user, leading to a possible Denial of Service DoS via a large amount of generated e-mail messages...

CVE-2022-27332: Missing Authentication for Critical Function

An access control issue in Zammad v5.0.3 allows attackers to write entries to the CTI caller log without authentication. This vulnerability can allow attackers to execute phishing attacks or cause a Denial of Service DoS...

CVE-2022-27331: Exposure of Resource to Wrong Sphere

An access control issue in Zammad v5.0.3 broadcasts administrative configuration changes to all users who have an active application instance, including settings that should only be visible to authenticated users...

Zammad 安全漏洞

Zammad is a suite of ticket management software from Zammad Germany. v5.1.0 of Zammad suffers from a denial of service vulnerability that stems from a lack of rate limiting in the forgot password feature, which could be exploited by an attacker to potentially cause a denial of service DoS via a...

Zammad has an unspecified vulnerability (CNVD-2022-22303)

Zammad is a suite of ticket management software from the German company Zammad. version 5.0.1 of Zammad contains a security vulnerability that stems from an LDAP configuration with privilege issues and is vulnerable to an attack with unauthorized access to existing user accounts. No details of th...

Zammad has an unspecified vulnerability (CNVD-2022-22302)

Zammad is a suite of ticket management software from the German company Zammad. a security vulnerability exists in Zammad, which stems from the ability of agents to configure out of office periods and substitutes. If substitutes do not have the same privileges as the original agent, they may...

CVE-2021-43145

With certain LDAP configurations, Zammad 5.0.1 was found to be vulnerable to unauthorized access with existing user accounts...

CVE-2021-44886

In Zammad 5.0.2, agents can configure "out of office" periods and substitute persons. If the substitute persons didn't have the same permissions as the original agent, they could receive ticket notifications for tickets that they have no access to...

CVE-2021-44886

In Zammad 5.0.2, agents can configure "out of office" periods and substitute persons. If the substitute persons didn't have the same permissions as the original agent, they could receive ticket notifications for tickets that they have no access to...

CVE-2021-43145

With certain LDAP configurations, Zammad 5.0.1 was found to be vulnerable to unauthorized access with existing user accounts...

CVE-2021-44886

In Zammad 5.0.2, agents can configure "out of office" periods and substitute persons. If the substitute persons didn't have the same permissions as the original agent, they could receive ticket notifications for tickets that they have no access to...

CVE-2021-43145

With certain LDAP configurations, Zammad 5.0.1 was found to be vulnerable to unauthorized access with existing user accounts...

Code injection

With certain LDAP configurations, Zammad 5.0.1 was found to be vulnerable to unauthorized access with existing user accounts...

Design/Logic Flaw

In Zammad 5.0.2, agents can configure "out of office" periods and substitute persons. If the substitute persons didn't have the same permissions as the original agent, they could receive ticket notifications for tickets that they have no access to...

CVE-2021-43145

With certain LDAP configurations, Zammad 5.0.1 was found to be vulnerable to unauthorized access with existing user accounts...

CVE-2021-43145

The CVE-2021-43145 entry concerns Zammad 5.0.1 vulnerable due to LDAP configuration issues that enable unauthorized access to existing user accounts. The connected records corroborate an LDAP‑related privilege problem, with CVSS v3.1 indicating a NETWORK attack vector, LOW complexity, and HIGH im...