CVE-2020-10100: Medium severity zammad vulnerability
An issue was discovered in Zammad 3.0 through 3.2. It allows for users to view ticket customer details associated with specific customers. However, the application does not properly implement access controls related to this functionality. As such, users of one company are able to access ticket data from other companies. Due to the multi-tenant nature of this application, users who can access ticket details from one organization to the next allows for users to exfiltrate potentially sensitive data of other companies.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2020-10100?
CVE-2020-10100 has a moderate severity level, impacting user data privacy.
How do I fix CVE-2020-10100?
To fix CVE-2020-10100, upgrade Zammad to version 3.3.0 or later, where access controls are properly implemented.
Who is affected by CVE-2020-10100?
CVE-2020-10100 affects Zammad versions 3.0 to 3.2.0, allowing unauthorized access to ticket customer details.
What are the implications of CVE-2020-10100?
The implications of CVE-2020-10100 include potential unauthorized access to sensitive customer ticket information.
Is CVE-2020-10100 a local or remote vulnerability?
CVE-2020-10100 is considered a local vulnerability, as it primarily affects authenticated users within the application.