CVE-2024-33668: Critical severity zammad vulnerability
Published Apr 26, 2024
·Updated
An issue was discovered in Zammad before 6.3.0. The Zammad Upload Cache uses insecure, partially guessable FormIDs to identify content. An attacker could try to brute force them to upload malicious content to article drafts they have no access to.
Affected Software
3 affected components
Zammad Zammad<6.3.0
Zammad Zammad>=6.2.0<6.3.0
Zammad Zammad=6.3.0-alpha
Event History
Apr 26, 2024
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via NVD·01:15 AM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2024-33668?
CVE-2024-33668 is classified as a high-severity vulnerability due to the potential for an attacker to upload malicious content.
2
How do I fix CVE-2024-33668?
To fix CVE-2024-33668, upgrade your Zammad installation to version 6.3.0 or later.
3
What is the impact of CVE-2024-33668 on Zammad?
The impact of CVE-2024-33668 allows an attacker to potentially upload harmful content to article drafts without proper access.
4
Who is affected by CVE-2024-33668?
CVE-2024-33668 affects all versions of Zammad before 6.3.0.
5
Is there a workaround for CVE-2024-33668?
There is no official workaround for CVE-2024-33668; upgrading to the latest version is recommended.