CVE-2020-29158

Опубликовано: 28 дек. 2020

Источник: nvd

CVSS3: 4.3

CVSS2: 4

EPSS Низкий

Описание

An issue was discovered in Zammad before 3.5.1. An Agent with Customer permissions in a Group can bypass intended access control on internal Articles via the Ticket detail view.

Ссылки

https://github.com/zammad/zammad/commit/cf5a5e396058d4b134dd33d0a62b11c1733c98ab
Patch
Third Party Advisory
https://zammad.com/en/advisories/zaa-2020-23
Vendor Advisory
https://github.com/zammad/zammad/commit/cf5a5e396058d4b134dd33d0a62b11c1733c98ab
Patch
Third Party Advisory
https://zammad.com/en/advisories/zaa-2020-23
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:zammad:zammad:*:*:*:*:*:*:*:*

Версия до 3.5.1 (исключая)

EPSS

Процентиль: 30%

0.00112

Низкий

4.3 Medium

CVSS3

4 Medium

CVSS2

Дефекты

CWE-862

Связанные уязвимости

CVE-2020-29158

CVSS3: 4.3

debian

около 5 лет назад

An issue was discovered in Zammad before 3.5.1. An Agent with Customer ...

GHSA-hh5m-6r25-ccqm

github

больше 3 лет назад