CVE-2021-44886

In Zammad 5.0.2, agents can configure "out of office" periods and substitute persons. If the substitute persons didn't have the same permissions as the original agent, they could receive ticket notifications for tickets that they have no access to.
References
Link Resource
https://zammad.com/en/advisories/zaa-2021-21 Vendor Advisory
Advertisement

NeevaHost hosting service

Configurations

Configuration 1 (hide)

cpe:2.3:a:zammad:zammad:5.0.2:*:*:*:*:*:*:*

Information

Published : 2022-02-04 07:15

Updated : 2022-02-09 08:16


NVD link : CVE-2021-44886

Mitre link : CVE-2021-44886


JSON object : View

CWE
CWE-668

Exposure of Resource to Wrong Sphere

Advertisement

dedicated server usa

Products Affected

zammad

  • zammad