PT-2020-16270 · Zammad · Zammad

Michał Błaszczak · Published 2020-12-28 · Updated 2020-12-29 · CVE-2020-26033

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Zammad versions prior to 3.4.1

Description An issue was discovered in the Tag and Link REST API endpoints for add and delete operations, which lack a CSRF token check. The "Tag and Link REST API endpoints" are affected, specifically the endpoints for adding and deleting.

Recommendations For versions prior to 3.4.1, update to version 3.4.1 or later to resolve the issue. As a temporary workaround, consider implementing a CSRF token check for the Tag and Link REST API endpoints until a patch is available.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2020-26033

Affected Products

Zammad

References · 6

• https://osv.dev/vulnerability/CVE-2020-26033 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-26033 · Security Note
• https://zammad.com/news/security-advisory-zaa-2020-17 · Vendor Advisory
• https://t.me/cvenotify/7868 · Telegram Post
• https://t.me/cvenotify/7798 · Telegram Post
• https://t.me/cibsecurity/21331 · Telegram Post