PT-2020-13938 · Zammad · Zammad

Published 2020-06-16 · Updated 2020-06-23 · CVE-2020-14213

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Zammad versions prior to 3.3.1

Description In Zammad, a customer has ticket access that should only be available to an agent, including the ability to read internal data, split, or merge tickets.

Recommendations For versions prior to 3.3.1, update to version 3.3.1 or later to resolve the issue.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2020-14213

Affected Products

Zammad

References · 4

• https://github.com/zammad/zammad/commit/6e56aee25439b7a3211a6704a9d60453ad623ae4 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2020-14213 · Security Note
• https://zammad.com/news/security-advisory-zaa-2020-13 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-14213 · Vendor Advisory