PT-2017-16624 · Zammad · Zammad

Publicado 2017-03-13 · Atualizado 2017-03-18 · CVE-2017-5620

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Zammad versions prior to 1.0.4 Zammad versions 1.1.x prior to 1.1.3 Zammad versions 1.2.x prior to 1.2.1

Description A cross-site scripting (XSS) issue was found. The problem arises because attachments are opened in a new tab instead of being downloaded, allowing code execution within the application's domain.

Recommendations For versions prior to 1.0.4, update to version 1.0.4 or later. For versions 1.1.x prior to 1.1.3, update to version 1.1.3 or later. For versions 1.2.x prior to 1.2.1, update to version 1.2.1 or later.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2017-5620

Produtos afetados

Zammad

Referências · 4

• https://zammad.com/de/news/security-advisory-zaa-2017-01 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2017-5620 · Aviso do Fabricante
• http://securityfocus.com/bid/96937 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-5620 · Nota de Segurança