CVE-2020-29158

2020-12-2808:15:11

Google

osv.dev

6.9 Medium

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

22.7%

JSON

An issue was discovered in Zammad before 3.5.1. An Agent with Customer permissions in a Group can bypass intended access control on internal Articles via the Ticket detail view.

CPENameOperatorVersion
zammadeq1.6.1
zammadeq1.6.0
zammadeq2.10.0
zammadeq3.7.0

Name	Operator	Version
zammad	eq	1.6.1
zammad	eq	1.6.0
zammad	eq	2.10.0
zammad	eq	3.7.0

References

github.com/zammad/zammad/commit/cf5a5e396058d4b134dd33d0a62b11c1733c98ab

zammad.com/en/advisories/zaa-2020-23