CVE-2022-40817: Medium severity Zammad Zammad vulnerability

Q: What is the vulnerability ID for this issue?

The vulnerability ID for this issue is CVE-2022-40817.

Q: What is the affected software?

The affected software is Zammad 5.2.1.

Q: What is the severity of CVE-2022-40817?

The severity of CVE-2022-40817 is medium with a severity value of 4.3.

Q: What operations were agents wrongly able to perform on tickets with read-only access?

Agents were wrongly able to perform operations such as adding and removing links, tags, and related answers on tickets with read-only access.

Q: How was the issue fixed?

The issue was fixed in Zammad 5.2.2.

Published Sep 27, 2022

Updated

Zammad 5.2.1 has a fine-grained permission model that allows to configure read-only access to tickets. However, agents were still wrongly able to perform some operations on such tickets, like adding and removing links, tags. and related answers. This issue has been fixed in 5.2.2.

Affected Software

1 affected component

Zammad Zammad>=5.2.0<5.2.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Zammad to a version that resolves this vulnerability.
Fixed in 5.2.2

Event History

Sep 27, 2022

CVE Published

via MITRE·03:24 PM

Data Sourced

via MITRE·03:24 PM

Description

Data Sourced

via NVD·11:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the vulnerability ID for this issue?

The vulnerability ID for this issue is CVE-2022-40817.

What is the affected software?

The affected software is Zammad 5.2.1.

What is the severity of CVE-2022-40817?

The severity of CVE-2022-40817 is medium with a severity value of 4.3.

What operations were agents wrongly able to perform on tickets with read-only access?