CVE-2022-35487

Zammad 5.2.0 suffers from Incorrect Access Control. Zammad did not correctly perform authorization on certain attachment endpoints. This could be abused by an unauthenticated attacker to gain access to attachments, such as emails or attached files.

Score

CVSS 3.1 7.5 High

Status

Modified - cve@mitre.org

Published

2022-08-08

Last modified

2024-08-03

Weaknesses

CWE-863

Affected products

• Zammad (Zammad)

References

• https://zammad.com/de/advisories/zaa-2022-08