PT-2022-12252 · Zammad · Zammad

Heiko Stämmler · Published 2022-02-04 · Updated 2023-08-08 · CVE-2021-44886

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Zammad version 5.0.2

Description The issue allows agents to configure "out of office" periods and substitute persons. If the substitute persons do not have the same permissions as the original agent, they could receive ticket notifications for tickets that they have no access to.

Recommendations For Zammad version 5.0.2, ensure that substitute persons have the same permissions as the original agent to prevent unauthorized access to ticket notifications. As a temporary workaround, consider restricting access to ticket notifications for substitute persons until a proper permission alignment can be established.

Fix

Related Identifiers

CVE-2021-44886

Affected Products

Zammad

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2021-44886 · Security Note
• https://osv.dev/vulnerability/CVE-2021-44886 · Vendor Advisory
• https://zammad.com/en/advisories/zaa-2021-21 · Vendor Advisory
• https://t.me/cibsecurity/36856 · Telegram Post