PT-2022-18378 · Zammad · Zammad

Published 2022-04-27 · Updated 2022-05-05 · CVE-2022-27331

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Zammad version 5.0.3

Description An access control issue broadcasts administrative configuration changes to all users who have an active application instance, including settings that should only be visible to authenticated users.

Recommendations For Zammad version 5.0.3, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exposure of Resource to Wrong Sphere

Weakness Enumeration

CWE-668

Related Identifiers

CVE-2022-27331

Affected Products

Zammad

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2022-27331 · Security Note
• https://osv.dev/vulnerability/CVE-2022-27331 · Vendor Advisory
• https://zammad.com/de/advisories/zaa-2022-02 · Vendor Advisory
• https://t.me/cibsecurity/41473 · Telegram Post