PT-2022-25554 · Zammad · Zammad

CVE-2022-40817 · Published 2022-09-27 · Updated 2022-09-29

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Zammad versions 5.2.1

Description The issue concerns a fine-grained permission model in Zammad that allows configuration of read-only access to tickets. However, agents were still able to perform certain operations on these tickets, such as adding and removing links, tags, and related answers, despite the read-only setting.

Recommendations For Zammad version 5.2.1, update to version 5.2.2 to resolve the issue.

Exploit

Fix

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

CVE-2022-40817

Affected Products

Zammad

References · 5

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/40xxx/CVE-2022-40817.json · Exploit
• https://osv.dev/vulnerability/CVE-2022-40817 · Vendor Advisory
• https://zammad.com/de/advisories/zaa-2022-10 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-40817 · Security Note
• https://t.me/cibsecurity/50548 · Telegram Post