PT-2025-15071 · Zammad · Zammad

Rodrigo Magalhães + 1 · Published 2025-04-05 · Updated 2025-04-06 · CVE-2025-32358

Positive Technologies (AI Summary)

CVSS v3.1

4.1

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Zammad versions 6.4.0 through 6.4.1

Description The issue allows for Server-Side Request Forgery (SSRF) to occur. Authenticated admin users can enable webhooks, which are triggered as POST requests when certain conditions are met. If a webhook endpoint returns a redirect response, it would be followed automatically with another GET request. This could be abused by an attacker to cause GET requests, for example, in the local network.

Recommendations For Zammad versions 6.4.0 through 6.4.1, update to version 6.4.2 or later to resolve the issue. As a temporary workaround, consider disabling the webhook feature until a patch is available. Restrict access to the webhook configuration to minimize the risk of exploitation. Avoid using the webhook endpoint in the affected Zammad version until the issue is resolved.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2025-32358

Affected Products

Zammad

References · 6

• https://zammad.com/en/advisories/zaa-2025-01 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-32358 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-32358 · Security Note
• https://t.me/cvetracker/20899 · Telegram Post
• https://twitter.com/CVEnew/status/1908663649193124084 · Twitter Post
• https://t.me/cvedetector/22197 · Telegram Post