CVE-2020-10104: Infoleak
First published: Thu Mar 05 2020(Updated: )
An issue was discovered in Zammad 3.0 through 3.2. After authentication, it transmits sensitive information to the user that may be compromised and used by an attacker to gain unauthorized access. Hashed passwords are returned to the user when visiting a certain URL.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Zammad Zammad | >=1.0.0<=3.2.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2020-10104?
CVE-2020-10104 is a vulnerability discovered in Zammad 3.0 through 3.2 that allows an attacker to gain unauthorized access by compromising sensitive information.
What is the severity of CVE-2020-10104?
The severity of CVE-2020-10104 is medium, with a severity value of 4.3.
How does CVE-2020-10104 affect Zammad?
CVE-2020-10104 affects Zammad versions from 3.0 through 3.2, transmitting sensitive information to the user that may be compromised and used by an attacker.
How can an attacker exploit CVE-2020-10104?
An attacker can exploit CVE-2020-10104 by visiting a specific URL, which returns hashed passwords to the user, allowing unauthorized access.
How can I fix CVE-2020-10104?
To fix CVE-2020-10104, it is recommended to upgrade to a version of Zammad that is not affected by the vulnerability.
- collector/nvd-index
- agent/references
- agent/severity
- agent/author
- agent/type
- agent/event
- agent/weakness
- agent/description
- agent/remedy
- agent/last-modified-date
- agent/softwarecombine
- agent/first-publish-date
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/zammad
- canonical/zammad zammad
- version/zammad zammad/1.0.0
- version/zammad zammad/3.2.0