CVE-2025-32357

Опубликовано: 05 апр. 2025

Источник: nvd

CVSS3: 4.3

EPSS Низкий

Описание

In Zammad 6.4.x before 6.4.2, an authenticated agent with knowledge base permissions was able to use the Zammad API to fetch knowledge base content that they have no permission for.

Ссылки

https://zammad.com/en/advisories/zaa-2025-04
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:zammad:zammad:*:*:*:*:*:*:*:*

Версия от 6.4.0 (включая) до 6.4.2 (исключая)

EPSS

Процентиль: 16%

0.00051

Низкий

4.3 Medium

CVSS3

Дефекты

CWE-288

CWE-306

Связанные уязвимости

CVE-2025-32357

CVSS3: 4.3

debian

10 месяцев назад

In Zammad 6.4.x before 6.4.2, an authenticated agent with knowledge ba ...

GHSA-9879-4r59-96j2

CVSS3: 4.3

github

10 месяцев назад

In Zammad 6.4.x before 6.4.2, an authenticated agent with knowledge base permissions was able to use the Zammad API to fetch knowledge base content that they have no permission for.

EPSS

Процентиль: 16%

0.00051

Низкий

4.3 Medium

CVSS3

Дефекты

CWE-288

CWE-306