Improper access control

2023-05-0216:15:00

PRIOn knowledge base

www.prio-n.com

zammad

authentication

access control

vulnerability

api

6.4 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

24.2%

JSON

Zammad 5.3.x (Fixed 5.4.0) is vulnerable to Incorrect Access Control. An authenticated attacker could gain information about linked accounts of users involved in their tickets using the Zammad API.

CPENameOperatorVersion
zammadge5.3.0
zammadlt5.4.0

CPE	Name	Operator	Version
	zammad	ge	5.3.0
	zammad	lt	5.4.0

References

zammad.com/en/advisories/zaa-2023-02