CVE-2022-40817
Severity Score
4.3
*CVSS v3.1
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
0
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
Zammad 5.2.1 has a fine-grained permission model that allows to configure read-only access to tickets. However, agents were still wrongly able to perform some operations on such tickets, like adding and removing links, tags. and related answers. This issue has been fixed in 5.2.2.
Zammad versión 5.2.1, presenta un modelo de permisos de grano fino que permite configurar el acceso de sólo lectura a los tickets. Sin embargo, los agentes todavía podían llevar a cabo erróneamente algunas operaciones en dichos tickets, como añadir y eliminar enlaces, etiquetas. y respuestas relacionadas. Este problema ha sido corregido en versión 5.2.2
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2022-09-19 CVE Reserved
- 2022-09-27 CVE Published
- 2024-04-19 EPSS Updated
- 2024-08-03 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-732: Incorrect Permission Assignment for Critical Resource
CAPEC
References (1)
| URL | Tag | Source |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://zammad.com/de/advisories/zaa-2022-10 | 2022-09-29 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Zammad Search vendor "Zammad" | Zammad Search vendor "Zammad" for product "Zammad" | >= 5.2.0 < 5.2.2 Search vendor "Zammad" for product "Zammad" and version " >= 5.2.0 < 5.2.2" | - |
Affected
| ||||||