CVE-2023-29867

EPSS 0.26%
Veröffentlicht 02.05.2023 16:15:08
Zuletzt bearbeitet 30.01.2025 17:15:15
Quelle cve@mitre.org
Teams Watchlist Login
Unerledigt Login

Zammad 5.3.x (Fixed 5.4.0) is vulnerable to Incorrect Access Control. An authenticated attacker could gain information about linked accounts of users involved in their tickets using the Zammad API.

Betroffene Produkte Warnungen 0 Metriken 3 CWE 1 Referenzen 4

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Zammad ≫ Zammad Version >= 5.3.0 < 5.4.0

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	0.26%	0.491

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
nvd@nist.gov	6.5	2.8	3.6	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
134c704f-9b21-4f2e-91b3-4a467353bcc0	6.5	2.8	3.6	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CWE-346 Origin Validation Error

The product does not properly verify that the source of data or communication is valid.

https://zammad.com/en/advisories/zaa-2023-02

Vendor Advisory

https://nvd.nist.gov/vuln/detail/CVE-2023-29867

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2023-29867

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2023-29867

EUVD