CVE-2022-27331

An access control issue in Zammad v5.0.3 broadcasts administrative configuration changes to all users who have an active application instance, including settings that should only be visible to authenticated users.

Score

CVSS 3.1 4.3 Medium

Status

Modified - cve@mitre.org

Published

2022-04-27

Last modified

2024-08-03

Weaknesses

CWE-668

Affected products

• Zammad (Zammad)

References

• https://zammad.com/de/advisories/zaa-2022-02