CVE-2020-29160: Missing Authorization

An issue was discovered in Zammad before 3.5.1. A REST API call allows an attacker to change Ticket Article data in a way that defeats auditing...

CVE-2020-26033: Cross-Site Request Forgery (CSRF)

An issue was discovered in Zammad before 3.4.1. The Tag and Link REST API endpoints for add and delete lack a CSRF token check...

CVE-2020-26028: Incorrect Authorization

An issue was discovered in Zammad before 3.4.1. Admin Users without a ticket. permission can access Tickets...

Zammad 安全漏洞

Zammad is a Web-based open source helpdesk/customer support system. An information disclosure vulnerability exists in Zammad versions prior to 3.4.1. The vulnerability can be exploited by an attacker to gain unauthorized access to a knowledge base draft via the global search function...

Zammad 安全漏洞

Zammad is a Web-based open source helpdesk/customer support system. An improper access control vulnerability exists in Zammad versions prior to 3.4.1. An attacker could exploit the vulnerability to access work orders...

Zammad 跨站请求伪造漏洞

Zammad is a suite of ticket management software from the German company Zammad. A cross-site request forgery vulnerability exists in versions prior to Zammad 3.5.1, which stems from a lack of CSRF token checking in the Labeling and Linking REST API endpoints used for additions and deletions. No...

Zammad 授权问题漏洞

Zammad is a Web-based open source helpdesk/customer support system. An SSO endpoint authentication bypass vulnerability exists in Zammad versions prior to 3.4.1. An attacker can exploit this vulnerability by creating a valid authentication session to perform any action in the name of another user...

Zammad Security Vulnerability

Zammad is a suite of ticket management software from the German company Zammad. A security vulnerability exists in versions prior to Zammad 3.5.1 that stems from the fact that the default registration role newly created user can be a privileged role configured by an administrator. This behavior w...

CVE-2020-26030: Improper Authentication

An issue was discovered in Zammad before 3.4.1. There is an authentication bypass in the SSO endpoint via a crafted header, when SSO is not configured. An attacker can create a valid and authenticated session that can be used to perform any actions in the name of other users...

CVE-2020-29159: Undefined Security Weakness

An issue was discovered in Zammad before 3.5.1. The default signup Role for newly created Users can be a privileged Role, if configured by an admin. This behvaior was unintended...

CVE-2020-26035: Improper Neutralization of Input During Web Page Generation

An issue was discovered in Zammad before 3.4.1. There is Stored XSS via a Tags element in a TIcket...

CVE-2020-26031: Incorrect Default Permissions

An issue was discovered in Zammad before 3.4.1. The global-search feature leaks Knowledge Base drafts to Knowledge Base readers who are authenticated but have insufficient permissions...

CVE-2020-29158: Missing Authorization

An issue was discovered in Zammad before 3.5.1. An Agent with Customer permissions in a Group can bypass intended access control on internal Articles via the Ticket detail view...

Zammad 安全漏洞

Zammad is a Web-based open source helpdesk/customer support system. An access control error vulnerability exists in Zammad versions prior to 3.5.1. An attacker can exploit this vulnerability to bypass auditing and change Ticket Article data via REST API calls...

Zammad Security Vulnerability

Zammad is a suite of ticket management software from the German company Zammad. A security vulnerability exists in Zammad versions prior to 3.4.1, where an incorrect authorization check is performed on simulated requests via X-On-Behalf-Of. The authorization check is performed for the actual user...

CVE-2020-26029: Incorrect Authorization

An issue was discovered in Zammad before 3.4.1. There are wrong authorization checks for impersonation requests via X-On-Behalf-Of. The authorization checks are performed for the actual user and not the one given in the X-On-Behalf-Of header...

Zammad 代码问题漏洞

Zammad is a Web-based open source helpdesk/customer support system. An information disclosure vulnerability exists in Zammad versions prior to 3.4.1. The vulnerability stems from the way Massenversand's implementation of the SMS configuration interface presents the results of test requests to the...

CVE-2020-26032: Server-Side Request Forgery (SSRF)

An SSRF issue was discovered in Zammad before 3.4.1. The SMS configuration interface for Massenversand is implemented in a way that renders the result of a test request to the User. An attacker can use this to request any URL via a GET request from the network interface of the server. This may le...

Zammad has an authorization problem vulnerability (CNVD-2021-22174)

Zammad is a Web-based open source helpdesk/customer support system. Zammad suffers from an authorization issue vulnerability that can be exploited by an attacker to access recent tickets, merge tickets, and split ticket functionality...

Zammad is vulnerable to authorization issues

Zammad is a Web-based open source helpdesk/customer support system. Zammad suffers from an authorization issue vulnerability that can be exploited by an attacker to register a new account using an email address that contains a non-existent domain of an existing organization, which in turn can be...