Описание
In Zammad 6.4.x before 6.4.2, an authenticated agent with knowledge base permissions was able to use the Zammad API to fetch knowledge base content that they have no permission for.
Ссылки
- Vendor Advisory
Уязвимые конфигурации
Конфигурация 1Версия от 6.4.0 (включая) до 6.4.2 (исключая)
cpe:2.3:a:zammad:zammad:*:*:*:*:*:*:*:*
EPSS
Процентиль: 17%
0.00258
Низкий
4.3 Medium
CVSS3
Дефекты
CWE-288
CWE-306
Связанные уязвимости
CVSS3: 4.3
debian
больше 1 года назад
In Zammad 6.4.x before 6.4.2, an authenticated agent with knowledge ba ...
CVSS3: 4.3
github
больше 1 года назад
In Zammad 6.4.x before 6.4.2, an authenticated agent with knowledge base permissions was able to use the Zammad API to fetch knowledge base content that they have no permission for.
EPSS
Процентиль: 17%
0.00258
Низкий
4.3 Medium
CVSS3
Дефекты
CWE-288
CWE-306