VulnerabilityModified
CVE-2022-40817
Zammad 5.2.1 has a fine-grained permission model that allows to configure read-only access to tickets.
MEDIUM 4.3EPSS 0.44%
Does this matter?
Lower severity and a low EPSS score (0.44%). Track it; it rarely justifies an emergency change on its own.
Description
Zammad 5.2.1 has a fine-grained permission model that allows to configure read-only access to tickets. However, agents were still wrongly able to perform some operations on such tickets, like adding and removing links, tags. and related answers. This issue has been fixed in 5.2.2.
- CVSS 3.1
- 4.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
- EPSS
- 0.44% probability · 38th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-732
- Affected
- zammad/zammad
- Source
- cve@mitre.org
References
- https://zammad.com/de/advisories/zaa-2022-10Vendor Advisory
- https://zammad.com/de/advisories/zaa-2022-10Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.