PT-2022-18379 · Zammad · Zammad

Published 2022-04-27 · Updated 2023-08-08 · CVE-2022-27332

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions Zammad version 5.0.3

Description An access control issue allows attackers to write entries to the CTI caller log without authentication. This can enable attackers to execute phishing attacks or cause a Denial of Service (DoS).

Recommendations For Zammad version 5.0.3, consider restricting access to the CTI caller log until a patch is available to prevent unauthorized writing of entries. As a temporary workaround, monitor the CTI caller log closely for suspicious activity to minimize the risk of exploitation.

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2022-27332

Affected Products

Zammad

References · 4

• https://osv.dev/vulnerability/CVE-2022-27332 · Vendor Advisory
• https://zammad.com/en/advisories/zaa-2022-01 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-27332 · Security Note
• https://t.me/cibsecurity/41474 · Telegram Post