PT-2020-11924 · Zammad · Zammad

Published 2020-03-05 · Updated 2021-07-21 · CVE-2020-10100

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Zammad versions 3.0 through 3.2

Description An issue in the application allows users to view ticket customer details associated with specific customers due to improper implementation of access controls. This enables users of one company to access ticket data from other companies, potentially leading to the exfiltration of sensitive data. The multi-tenant nature of the application exacerbates this issue, as users can access ticket details from one organization to the next.

Recommendations For Zammad versions 3.0 through 3.2, consider restricting access to ticket customer details to prevent users from accessing data from other companies until a proper fix is implemented. As a temporary workaround, limit the functionality that allows users to view ticket customer details associated with specific customers.

Fix

Related Identifiers

CVE-2020-10100

Affected Products

Zammad

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2020-10100 · Security Note
• https://osv.dev/vulnerability/CVE-2020-10100 · Vendor Advisory
• https://zammad.com/news/security-advisory-zaa-2020-05 · Vendor Advisory
• https://t.me/cvenotify/1345 · Telegram Post