PT-2020-11928 · Zammad · Zammad

Published 2020-03-05 · Updated 2020-03-05 · CVE-2020-10104

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Zammad versions 3.0 through 3.2

Description An issue was discovered in Zammad where, after authentication, it transmits sensitive information to the user that may be compromised and used by an attacker to gain unauthorized access. Specifically, hashed passwords are returned to the user when visiting a certain URL.

Recommendations For Zammad versions 3.0 through 3.2, as a temporary workaround, consider restricting access to the URL that returns hashed passwords to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2020-10104

Affected Products

Zammad

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2020-10104 · Security Note
• https://osv.dev/vulnerability/CVE-2020-10104 · Vendor Advisory
• https://zammad.com/news/security-advisory-zaa-2020-04 · Vendor Advisory
• https://t.me/cvenotify/1349 · Telegram Post