Lucene search

GoogleOSV:CVE-2022-48021

HistoryFeb 03, 2023 - 1:15 a.m.

CVE-2022-48021

2023-02-0301:15:13

Google

osv.dev

zammad v5.3.0

vulnerability

execute arbitrary code

escalate privileges

crafted message

server

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.7 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

65.0%

JSON

A vulnerability in Zammad v5.3.0 allows attackers to execute arbitrary code or escalate privileges via a crafted message sent to the server.

CPENameOperatorVersion
zammadeq5.3.0-alpha
zammadeq1.6.0
zammadeq2.10.0
zammadeq1.6.1
zammadeq3.7.0
zammadeq5.3.0
zammadeq5.2.0-alpha

Name	Operator	Version
zammad	eq	5.3.0-alpha
zammad	eq	1.6.0
zammad	eq	2.10.0
zammad	eq	1.6.1
zammad	eq	3.7.0
zammad	eq	5.3.0
zammad	eq	5.2.0-alpha

References

zammad.com/de/advisories/zaa-2022-11

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.7 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

65.0%

JSON

Related for OSV:CVE-2022-48021