PT-2021-20877 · Zammad · Zammad

Lutfu + 1 · Published 2021-06-28 · Updated 2021-07-02 · CVE-2021-35300

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Zammad versions 1.0.x through 4.0.0

Description: The issue allows remote attackers to manipulate users into visiting the attackers' page through text injection or content spoofing in the 404 page.

Recommendations: For Zammad versions 1.0.x through 4.0.0, consider restricting access to the 404 page until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Clickjacking

Weakness Enumeration

CWE-1021

Related Identifiers

CVE-2021-35300

Affected Products

Zammad

References · 4

• https://zammad.com/en/advisories/zaa-2021-07 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-35300 · Security Note
• https://osv.dev/vulnerability/CVE-2021-35300 · Vendor Advisory
• https://t.me/cibsecurity/25769 · Telegram Post