PT-2020-11922 · Zammad · Zammad

Christopher Friedrichs · Published 2020-03-05 · Updated 2020-03-05 · CVE-2020-10098

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Zammad versions 3.0 through 3.2

Description A cross-site scripting (XSS) issue was discovered, allowing malicious code to be provided by a low-privileged user through the Email functionality. The malicious JavaScript will execute within the browser of any user who opens the Ticket with the Article created from that Email.

Recommendations For Zammad versions 3.0 through 3.2, consider disabling the Email functionality until a patch is available to prevent exploitation of the XSS issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-10098

Affected Products

Zammad

References · 4

• https://osv.dev/vulnerability/CVE-2020-10098 · Vendor Advisory
• https://zammad.com/news/security-advisory-zaa-2020-03 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-10098 · Security Note
• https://t.me/cvenotify/1343 · Telegram Post