PT-2023-15554 · Zammad · Zammad

Published 2023-02-03 · Updated 2023-02-09 · CVE-2022-48023

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Zammad version 5.3.0

Description Insufficient privilege verification allows an authenticated attacker to perform changes on the tags of their customer tickets using the Zammad API. The issue has been corrected so that only agents with write permissions may change ticket tags.

Recommendations For Zammad version 5.3.0, update to version 5.3.1 to resolve the issue.

Fix

Related Identifiers

CVE-2022-48023

Affected Products

Zammad

References · 4

• https://osv.dev/vulnerability/CVE-2022-48023 · Vendor Advisory
• https://zammad.com/de/advisories/zaa-2022-12 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-48023 · Security Note
• https://t.me/cibsecurity/57438 · Telegram Post