CVE-2022-48023 in Zammad

Сводка

по MITRE • 03.02.2023

Insufficient privilege verification in Zammad v5.3.0 allows an authenticated attacker to perform changes on the tags of their customer tickets using the Zammad API. This is now corrected in v5.3.1 so that only agents with write permissions may change ticket tags.

Be aware that VulDB is the high quality source for vulnerability data.

• Резервировать: 29.12.2022
• Раскрытие: 03.02.2023
• Модерация: принято
• Вход: VDB-220088
• CPE: готов
• CWE: CWE-275 (Подтверждённый)
• CVSS: 5.5 (VulDB)
• EPSS: 0.00449
• KEV: Нет
• Деятельности: Очень низкий

Источники

• MITRE: https://www.cve.org/CVERecord?id=CVE-2022-48023
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2022-48023
• CVE Details: https://www.cvedetails.com/cve/CVE-2022-48023/