PT-2022-22864 · Zammad · Zammad

Joe Helle · Published 2022-08-08 · Updated 2023-08-08 · CVE-2022-35488

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Zammad version 5.2.0

Description The issue allows an attacker to manipulate the rate limiting in the 'forgot password' feature, enabling them to send numerous requests for a known account. This can cause Denial Of Service due to the generation of many emails, which also results in spamming the victim.

Recommendations For Zammad version 5.2.0, consider temporarily disabling the 'forgot password' feature until a patch is available to prevent exploitation. Restrict access to this feature to minimize the risk of Denial Of Service and spamming attacks.

Fix

Related Identifiers

CVE-2022-35488

Affected Products

Zammad

References · 3

• https://zammad.com/de/advisories/zaa-2022-05 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-35488 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-35488 · Security Note