DeutschShown in its original language — a full translation is planned for a future version.
Zammad: Mehrere Schwachstellen
view advisory published 2025-04-01
Ein entfernter Angreifer kann mehrere Schwachstellen in Zammad ausnutzen, um Informationen offenzulegen oder Sicherheitsvorkehrungen zu umgehen.
01
describes (4)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2025-32360US | high8.1 | — | ||
In Zammad 6.4.x before 6.4.2, there is information exposure. Only agents should be able to see and work on shared article drafts. However, a logged in customer was able to see deta… | ||||
| CVE-2025-32359US | high8.8 | — | ||
In Zammad 6.4.x before 6.4.2, there is client-side enforcement of server-side security. When changing their two factor authentication configuration, users need to re-authenticate w… | ||||
| CVE-2025-32358US | medium4.1 | — | ||
In Zammad 6.4.x before 6.4.2, SSRF can occur. Authenticated admin users can enable webhooks in Zammad, which are triggered as POST requests when certain conditions are met. If a we… | ||||
| CVE-2025-32357US | medium4.3OT elevated | — | ||
In Zammad 6.4.x before 6.4.2, an authenticated agent with knowledge base permissions was able to use the Zammad API to fetch knowledge base content that they have no permission for… | ||||
02
references
External citations — patches, advisories, analysis.
- WID-SEC-W-2025-0684 - CSAF Versionself
- WID-SEC-2025-0684 - Portal Versionself
- Zammad Security Advisory vom 2025-04-01external
- Zammad Security Advisory vom 2025-04-01external
- Zammad Security Advisory vom 2025-04-01external
- Zammad Security Advisory vom 2025-04-01external
- Zammad Release Notes vom 2025-04-01external
- Zammad Release Notes vom 2025-04-01external
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan