CVE-2020-10103

An XSS issue was discovered in Zammad 3.0 through 3.2. Malicious code can be provided by a low-privileged user through the File Upload functionality in Zammad. The malicious JavaScript will execute within the browser of any user who opens a specially crafted link to the uploaded file with an active Zammad session.

Score

CVSS 3.1 5.4 Medium

Status

Modified - cve@mitre.org

Published

2020-03-05

Last modified

2024-08-04

Weaknesses

CWE-79

Affected products

• Zammad (Zammad)

References

• https://zammad.com/news/security-advisory-zaa-2020-02