CVE-2022-40817

Published: Sep 27, 2022Modified: May 21, 2025

4.3

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Exploitability: 2.8 / Impact: 1.4

Source: NVD

Description

Zammad 5.2.1 has a fine-grained permission model that allows to configure read-only access to tickets. However, agents were still wrongly able to perform some operations on such tickets, like adding and removing links, tags. and related answers. This issue has been fixed in 5.2.2.

Affected (1)

Products: Zammad: Zammad

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Zammad Zammad	From 5.2.0 to 5.2.2

Related CWEs

Incorrect Permission Assignment for Critical Resource

The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.

References (2)

https://zammad.com/de/advisories/zaa-2022-10

Source: cve@mitre.org

Vendor Advisory

https://zammad.com/de/advisories/zaa-2022-10

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.