PT-2024-25425 · Zammad · Zammad

Johannes Ludwig · Published 2024-04-26 · Updated 2024-07-03 · CVE-2024-33668

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Zammad versions prior to 6.3.0

Description An issue was discovered where the Zammad Upload Cache uses insecure, partially guessable FormIDs to identify content. This could allow an attacker to brute force these IDs and upload malicious content to article drafts they do not have access to.

Recommendations For versions prior to 6.3.0, update to version 6.3.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the Zammad Upload Cache to minimize the risk of exploitation.

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2024-33668

Affected Products

Zammad

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2024-33668 · Security Note
• https://osv.dev/vulnerability/CVE-2024-33668 · Vendor Advisory
• https://zammad.com/en/advisories/zaa-2024-02 · Vendor Advisory
• https://t.me/cvenotify/78075 · Telegram Post