PT-2020-11923 · Zammad · Zammad

Published 2020-03-05 · Updated 2020-03-05 · CVE-2020-10099

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Zammad versions 3.0 through 3.2

Description A cross-site scripting (XSS) issue was discovered, allowing malicious code to be provided by a low-privileged user through the Ticket functionality. The malicious JavaScript will execute within the browser of any user who opens the ticket or has the ticket within the Toolbar.

Recommendations For Zammad versions 3.0 through 3.2, consider disabling the Ticket functionality until a patch is available to prevent the execution of malicious JavaScript code. Restrict access to the Ticket functionality to minimize the risk of exploitation. Avoid using the Ticket functionality in a way that could allow malicious code to be executed within the browser of other users. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-10099

Affected Products

Zammad

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2020-10099 · Security Note
• https://osv.dev/vulnerability/CVE-2020-10099 · Vendor Advisory
• https://zammad.com/news/security-advisory-zaa-2020-01 · Vendor Advisory
• https://t.me/cvenotify/1344 · Telegram Post