PT-2021-20880 · Zammad · Zammad

N: Chung + 1 · Published 2021-06-28 · Updated 2021-07-02 · CVE-2021-35303

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Zammad versions 1.0.x through 4.0.0

Description: The issue allows remote attackers to execute arbitrary web script or HTML via the User Avatar attribute, enabling Cross Site Scripting (XSS) attacks. This can lead to the execution of malicious scripts on the victim's browser.

Recommendations: For versions 1.0.x through 4.0.0, update to a version later than 4.0.0 to resolve the issue. As a temporary workaround, consider restricting access to the User Avatar attribute to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-35303

Affected Products

Zammad

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2021-35303 · Security Note
• https://osv.dev/vulnerability/CVE-2021-35303 · Vendor Advisory
• https://zammad.com/en/advisories/zaa-2021-06 · Vendor Advisory
• https://t.me/cibsecurity/25765 · Telegram Post
• https://t.me/cvenotify/16988 · Telegram Post