CVE-2023-29868

EPSS 0.14%
Published 02.05.2023 16:15:08
Last modified 30.01.2025 17:15:15
Source cve@mitre.org
Teams watchlist Login
Open Login

Zammad 5.3.x (Fixed in 5.4.0) is vulnerable to Incorrect Access Control. An authenticated attacker with agent and customer roles could perform unauthorized changes on articles where they only have customer permissions.

Affected products Warnungen 0 Metrics 3 CWE 1 References 4

Data is provided by the National Vulnerability Database (NVD)

Zammad ≫ Zammad Version >= 5.3.0 < 5.4.0

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Type	Source	Score	Percentile
EPSS	FIRST.org	0.14%	0.353

CVSS Metriken
Source	Base Score	Exploit Score	Impact Score	Vector string
nvd@nist.gov	6.5	2.8	3.6	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
134c704f-9b21-4f2e-91b3-4a467353bcc0	6.5	2.8	3.6	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

CWE-346 Origin Validation Error

The product does not properly verify that the source of data or communication is valid.

https://zammad.com/en/advisories/zaa-2023-01

Vendor Advisory

https://nvd.nist.gov/vuln/detail/CVE-2023-29868

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2023-29868

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2023-29868

EUVD