CVE-2024-36078: Code Injection
In Zammad before 6.3.1, a Ruby gem bundled by Zammad is installed with world-writable file permissions. This allowed a local attacker on the server to modify the gem's files, injecting arbitrary code into Zammad processes (which run with the environment and permissions of the Zammad user).
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-36078?
CVE-2024-36078 has been categorized as a high severity vulnerability as it allows local attackers to inject arbitrary code.
How do I fix CVE-2024-36078?
To fix CVE-2024-36078, update Zammad to version 6.3.1 or later to remove the world-writable permissions on the Ruby gem.
Who is affected by CVE-2024-36078?
CVE-2024-36078 affects Zammad installations prior to version 6.3.1.
What type of vulnerability is CVE-2024-36078?
CVE-2024-36078 is a local file permission vulnerability that can lead to code injection.
Can CVE-2024-36078 be exploited remotely?
No, CVE-2024-36078 requires local access to the server to exploit the vulnerability.