Zammad Security Vulnerabilities
An issue was discovered in Zammad before 1.0.4, 1.1.x before 1.1.3, and 1.2.x before 1.2.1. Attackers can login with the hashed password itself (e.g., from the DB) instead of the valid password string.
9.8CVSS
9.5AI Score
0.003EPSS
An XSS issue was discovered in Zammad before 1.0.4, 1.1.x before 1.1.3, and 1.2.x before 1.2.1. Attachments are opened in a new tab instead of getting downloaded. This creates an attack vector of executing code in the domain of the application.
6.1CVSS
6AI Score
0.001EPSS
An issue was discovered in Zammad before 1.0.4, 1.1.x before 1.1.3, and 1.2.x before 1.2.1. XSS can be triggered via malicious HTML in a chat message or the content of a ticket article, when using either the REST API or the WebSocket API.
6.1CVSS
5.9AI Score
0.001EPSS
An issue was discovered in Zammad before 1.0.4, 1.1.x before 1.1.3, and 1.2.x before 1.2.1, caused by lack of a protection mechanism involving HTTP Access-Control headers. To exploit the vulnerability, an attacker can send cross-domain requests directly to the REST API for users with a valid sessio...
9.8CVSS
9.3AI Score
0.001EPSS
A CSRF issue was discovered in Zammad before 1.0.4, 1.1.x before 1.1.3, and 1.2.x before 1.2.1. To exploit the vulnerability, an attacker can send cross-domain requests directly to the REST API for users with a valid session cookie.
8.8CVSS
8.6AI Score
0.001EPSS
Zammad GmbH Zammad version 2.3.0 and earlier contains a Improper Neutralization of Script-Related HTML Tags in a Web Page (CWE-80) vulnerability in the subject of emails which are not html quoted in certain cases. This can result in the embedding and execution of java script code on users browser. ...
6.1CVSS
6.4AI Score
0.002EPSS
Zammad GmbH Zammad 2.3.0 and earlier is affected by: Cross Site Scripting (XSS) - CWE-80. The impact is: Execute java script code on users browser. The component is: web app. The attack vector is: the victim must open a ticket. The fixed version is: 2.3.1, 2.2.2 and 2.1.3.
6.1CVSS
6.1AI Score
0.001EPSS
An issue was discovered in Zammad 3.0 through 3.2. It does not prevent caching of confidential data within browser memory. An attacker who either remotely compromises or obtains physical access to a user's workstation can browse the browser cache contents and obtain sensitive information. The attac...
7.5CVSS
7.1AI Score
0.002EPSS
An issue was discovered in Zammad 3.0 through 3.2. It may respond with verbose error messages that disclose internal application or infrastructure information. This information could aid attackers in successfully exploiting other vulnerabilities.
5.3CVSS
5.1AI Score
0.001EPSS
An XSS issue was discovered in Zammad 3.0 through 3.2. Malicious code can be provided by a low-privileged user through the Email functionality. The malicious JavaScript will execute within the browser of any user who opens the Ticket with the Article created from that Email.
5.4CVSS
5.3AI Score
0.001EPSS
An XSS issue was discovered in Zammad 3.0 through 3.2. Malicious code can be provided by a low-privileged user through the Ticket functionality in Zammad. The malicious JavaScript will execute within the browser of any user who opens the ticket or has the ticket within the Toolbar.
5.4CVSS
5.3AI Score
0.001EPSS
An issue was discovered in Zammad 3.0 through 3.2. It allows for users to view ticket customer details associated with specific customers. However, the application does not properly implement access controls related to this functionality. As such, users of one company are able to access ticket data...
6.5CVSS
6.3AI Score
0.001EPSS
An issue was discovered in Zammad 3.0 through 3.2. The WebSocket server crashes when messages in non-JSON format are sent by an attacker. The message format is not properly checked and parsing errors not handled. This leads to a crash of the service process.
7.5CVSS
7.4AI Score
0.001EPSS
An issue was discovered in Zammad 3.0 through 3.2. The Forgot Password functionality is implemented in a way that would enable an anonymous user to guess valid user emails. In the current implementation, the application responds differently depending on whether the input supplied was recognized as ...
5.3CVSS
5.1AI Score
0.001EPSS
An XSS issue was discovered in Zammad 3.0 through 3.2. Malicious code can be provided by a low-privileged user through the File Upload functionality in Zammad. The malicious JavaScript will execute within the browser of any user who opens a specially crafted link to the uploaded file with an active...
5.4CVSS
5.3AI Score
0.001EPSS
An issue was discovered in Zammad 3.0 through 3.2. After authentication, it transmits sensitive information to the user that may be compromised and used by an attacker to gain unauthorized access. Hashed passwords are returned to the user when visiting a certain URL.
4.3CVSS
4.5AI Score
0.001EPSS
An issue was discovered in Zammad 3.0 through 3.2. It returns source code of static resources when submitting an OPTIONS request, rather than a GET request. Disclosure of source code allows for an attacker to formulate more precise attacks. Source code was disclosed for the file 404.html (/zammad/p...
5.3CVSS
5.3AI Score
0.001EPSS
In Zammad before 3.3.1, a Customer has ticket access that should only be available to an Agent (e.g., read internal data, split, or merge).
5.4CVSS
5.3AI Score
0.001EPSS
Zammad before 3.3.1, when Domain Based Assignment is enabled, relies on a claimed e-mail address for authorization decisions. An attacker can register a new account that will have access to all tickets of an arbitrary Organization.
6.5CVSS
6.4AI Score
0.001EPSS
An issue was discovered in Zammad before 3.4.1. Admin Users without a ticket.* permission can access Tickets.
4.9CVSS
5.1AI Score
0.001EPSS
An issue was discovered in Zammad before 3.4.1. There are wrong authorization checks for impersonation requests via X-On-Behalf-Of. The authorization checks are performed for the actual user and not the one given in the X-On-Behalf-Of header.
6.5CVSS
6.5AI Score
0.001EPSS
An issue was discovered in Zammad before 3.4.1. There is an authentication bypass in the SSO endpoint via a crafted header, when SSO is not configured. An attacker can create a valid and authenticated session that can be used to perform any actions in the name of other users.
9.8CVSS
9.2AI Score
0.004EPSS
An issue was discovered in Zammad before 3.4.1. The global-search feature leaks Knowledge Base drafts to Knowledge Base readers (who are authenticated but have insufficient permissions).
4.3CVSS
4.5AI Score
0.001EPSS
An SSRF issue was discovered in Zammad before 3.4.1. The SMS configuration interface for Massenversand is implemented in a way that renders the result of a test request to the User. An attacker can use this to request any URL via a GET request from the network interface of the server. This may lead...
7.5CVSS
7.2AI Score
0.002EPSS
An issue was discovered in Zammad before 3.4.1. The Tag and Link REST API endpoints (for add and delete) lack a CSRF token check.
5.4CVSS
5.5AI Score
0.001EPSS
An account-enumeration issue was discovered in Zammad before 3.4.1. The Create User functionality is implemented in a way that would enable an anonymous user to guess valid user email addresses. The application responds differently depending on whether the input supplied was recognized as associate...
4.3CVSS
4.5AI Score
0.001EPSS
An issue was discovered in Zammad before 3.4.1. There is Stored XSS via a Tags element in a TIcket.
5.4CVSS
5AI Score
0.001EPSS
An issue was discovered in Zammad before 3.5.1. An Agent with Customer permissions in a Group can bypass intended access control on internal Articles via the Ticket detail view.
4.3CVSS
4.7AI Score
0.001EPSS
An issue was discovered in Zammad before 3.5.1. The default signup Role (for newly created Users) can be a privileged Role, if configured by an admin. This behvaior was unintended.
4.9CVSS
5AI Score
0.001EPSS
An issue was discovered in Zammad before 3.5.1. A REST API call allows an attacker to change Ticket Article data in a way that defeats auditing.
7.5CVSS
7.4AI Score
0.001EPSS
Cross Site Scripting (XSS) in Zammad 1.0.x up to 4.0.0 allows remote attackers to execute arbitrary web script or HTML via multiple models that contain a 'note' field to store additional information.
6.1CVSS
6.1AI Score
0.001EPSS
Incorrect Access Control in Zammad 1.0.x up to 4.0.0 allows attackers to obtain sensitive information via email connection configuration probing.
7.5CVSS
7.2AI Score
0.002EPSS
Text injection/Content Spoofing in 404 page in Zammad 1.0.x up to 4.0.0 could allow remote attackers to manipulate users into visiting the attackers' page.
4.3CVSS
4.6AI Score
0.001EPSS
Incorrect Access Control in Zammad 1.0.x up to 4.0.0 allows remote attackers to obtain sensitive information via the Ticket Article detail view.
5.3CVSS
5.1AI Score
0.002EPSS
Incorrect Access Control for linked Tickets in Zammad 1.0.x up to 4.0.0 allows remote attackers to obtain sensitive information.
5.3CVSS
5.2AI Score
0.002EPSS
Cross Site Scripting (XSS) in Zammad 1.0.x up to 4.0.0 allows remote attackers to execute arbitrary web script or HTML via the User Avatar attribute.
6.1CVSS
6.1AI Score
0.001EPSS
An issue was discovered in Zammad before 4.1.1. An attacker with valid agent credentials may send a series of crafted requests that cause an endless loop and thus cause denial of service.
6.5CVSS
6.4AI Score
0.001EPSS
An issue was discovered in Zammad before 4.1.1. There is stored XSS via a custom Avatar.
5.4CVSS
5.1AI Score
0.001EPSS
An issue was discovered in Zammad before 4.1.1. An Agent account can modify account data, and gain admin access, via a crafted request.
8.8CVSS
8.6AI Score
0.001EPSS
An issue was discovered in Zammad before 4.1.1. An admin can discover the application secret via the API.
4.9CVSS
5.1AI Score
0.001EPSS
An issue was discovered in Zammad before 4.1.1. The Chat functionality allows XSS because clipboard data is mishandled.
6.1CVSS
5.9AI Score
0.001EPSS
An issue was discovered in Zammad before 4.1.1. The REST API discloses sensitive information.
7.5CVSS
7.5AI Score
0.002EPSS
An issue was discovered in Zammad before 4.1.1. The Form functionality allows remote code execution because deserialization is mishandled.
9.8CVSS
9.8AI Score
0.011EPSS
An issue was discovered in Zammad before 4.1.1. SSRF can occur via GitHub or GitLab integration.
9.1CVSS
9.1AI Score
0.002EPSS
An issue was discovered in Zammad before 4.1.1. Stored XSS may occur via an Article during addition of an attachment to a Ticket.
5.4CVSS
5.1AI Score
0.001EPSS
An issue was discovered in Zammad before 4.1.1. An admin can execute code on the server via a crafted request that manipulates triggers.
7.2CVSS
7AI Score
0.001EPSS
An issue was discovered in Zammad before 4.1.1. Command Injection can occur via custom Packages.
9.8CVSS
9.6AI Score
0.005EPSS
An issue was discovered in Zammad before 5.0.1. In some cases, there is improper enforcement of the privilege requirement for viewing a list of tickets that shows title, state, etc.
5.3CVSS
5.3AI Score
0.001EPSS
With certain LDAP configurations, Zammad 5.0.1 was found to be vulnerable to unauthorized access with existing user accounts.
8.1CVSS
7.9AI Score
0.001EPSS
In Zammad 5.0.2, agents can configure "out of office" periods and substitute persons. If the substitute persons didn't have the same permissions as the original agent, they could receive ticket notifications for tickets that they have no access to.
5.3CVSS
5.3AI Score
0.001EPSS