CVE-2020-14214

Опубликовано: 16 июн. 2020

Источник: nvd

CVSS3: 6.5

CVSS2: 5.8

EPSS Низкий

Описание

Zammad before 3.3.1, when Domain Based Assignment is enabled, relies on a claimed e-mail address for authorization decisions. An attacker can register a new account that will have access to all tickets of an arbitrary Organization.

Ссылки

https://github.com/zammad/zammad/commit/40148392426f626cb779c76d6bdda0f67bd6069d
Patch
Third Party Advisory
https://zammad.com/news/security-advisory-zaa-2020-12
Vendor Advisory
https://github.com/zammad/zammad/commit/40148392426f626cb779c76d6bdda0f67bd6069d
Patch
Third Party Advisory
https://zammad.com/news/security-advisory-zaa-2020-12
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:zammad:zammad:*:*:*:*:*:*:*:*

Версия до 3.3.1 (исключая)

EPSS

Процентиль: 41%

0.00186

Низкий

6.5 Medium

CVSS3

5.8 Medium

CVSS2

Дефекты

CWE-863

Связанные уязвимости

CVE-2020-14214

CVSS3: 6.5

debian

больше 5 лет назад

Zammad before 3.3.1, when Domain Based Assignment is enabled, relies o ...

GHSA-655m-24cc-cx96

github

больше 3 лет назад