In Zammad 5.0.2, agents can configure "out of office" periods and substitute persons. If the substitute persons didn't have the same permissions as the original agent, they could receive ticket notifications for tickets that they have no access to.
References
Link | Resource |
---|---|
https://zammad.com/en/advisories/zaa-2021-21 | Vendor Advisory |
Configurations
Information
Published : 2022-02-04 07:15
Updated : 2022-02-09 08:16
NVD link : CVE-2021-44886
Mitre link : CVE-2021-44886
JSON object : View
CWE
CWE-668
Exposure of Resource to Wrong Sphere
Products Affected
zammad
- zammad