PT-2023-15554 · Zammad · Zammad

CVE-2022-48023 · Publicado 2023-02-03 · Atualizado 2023-02-09

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Zammad version 5.3.0

Description Insufficient privilege verification allows an authenticated attacker to perform changes on the tags of their customer tickets using the Zammad API. The issue has been corrected so that only agents with write permissions may change ticket tags.

Recommendations For Zammad version 5.3.0, update to version 5.3.1 to resolve the issue.

Exploit

Correção

Identificadores relacionados

CVE-2022-48023

Produtos afetados

Zammad

Referências · 5

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/48xxx/CVE-2022-48023.json · Exploit
• https://osv.dev/vulnerability/CVE-2022-48023 · Aviso do Fabricante
• https://t.me/cibsecurity/57438 · Publicação no Telegram
• https://zammad.com/de/advisories/zaa-2022-12 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2022-48023 · Nota de Segurança