CVE-2020-10104: Infoleak
An issue was discovered in Zammad 3.0 through 3.2. After authentication, it transmits sensitive information to the user that may be compromised and used by an attacker to gain unauthorized access. Hashed passwords are returned to the user when visiting a certain URL.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2020-10104?
CVE-2020-10104 is a vulnerability discovered in Zammad 3.0 through 3.2 that allows an attacker to gain unauthorized access by compromising sensitive information.
What is the severity of CVE-2020-10104?
The severity of CVE-2020-10104 is medium, with a severity value of 4.3.
How does CVE-2020-10104 affect Zammad?
CVE-2020-10104 affects Zammad versions from 3.0 through 3.2, transmitting sensitive information to the user that may be compromised and used by an attacker.
How can an attacker exploit CVE-2020-10104?
An attacker can exploit CVE-2020-10104 by visiting a specific URL, which returns hashed passwords to the user, allowing unauthorized access.
How can I fix CVE-2020-10104?
To fix CVE-2020-10104, it is recommended to upgrade to a version of Zammad that is not affected by the vulnerability.