PT-2020-16269 · Zammad · Zammad

Published 2020-12-28 · Updated 2020-12-29 · CVE-2020-26032

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Zammad versions prior to 3.4.1

Description A Server-Side Request Forgery (SSRF) issue was discovered in the SMS configuration interface for Massenversand. This interface is implemented in a way that renders the result of a test request to the user, allowing an attacker to request any URL via a GET request from the network interface of the server. This may lead to disclosure of information from intranet systems.

Recommendations For versions prior to 3.4.1, update to version 3.4.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the SMS configuration interface for Massenversand to minimize the risk of exploitation.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2020-26032

Affected Products

Zammad

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2020-26032 · Security Note
• https://zammad.com/news/security-advisory-zaa-2020-15 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-26032 · Vendor Advisory
• https://t.me/cvenotify/7802 · Telegram Post
• https://t.me/cibsecurity/21338 · Telegram Post
• https://t.me/cvenotify/7869 · Telegram Post