CVE-2020-10100

EPSS 0.41%
Veröffentlicht 05.03.2020 01:15:11
Zuletzt bearbeitet 21.11.2024 04:54:48
Quelle cve@mitre.org
CVE-Watchlists
Login
Unerledigt
Login

An issue was discovered in Zammad 3.0 through 3.2. It allows for users to view ticket customer details associated with specific customers. However, the application does not properly implement access controls related to this functionality. As such, users of one company are able to access ticket data from other companies. Due to the multi-tenant nature of this application, users who can access ticket details from one organization to the next allows for users to exfiltrate potentially sensitive data of other companies.

Betroffene Produkte Warnungen 0 Metriken 3 CWE 0 Referenzen 4

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Zammad ≫ Zammad Version >= 1.0.0 <= 3.2.0

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	0.41%	0.603

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
nvd@nist.gov	6.5	2.8	3.6	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
nvd@nist.gov	4	8	2.9	AV:N/AC:L/Au:S/C:P/I:N/A:N

https://zammad.com/news/security-advisory-zaa-2020-05

Patch

Vendor Advisory

https://nvd.nist.gov/vuln/detail/CVE-2020-10100

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2020-10100

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2020-10100

EUVD