CVE-2025-32358: SSRF
In Zammad 6.4.x before 6.4.2, SSRF can occur. Authenticated admin users can enable webhooks in Zammad, which are triggered as POST requests when certain conditions are met. If a webhook endpoint returned a redirect response, Zammad would follow it automatically with another GET request. This could be abused by an attacker to cause GET requests for example in the local network.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-32358?
CVE-2025-32358 has been classified with a notable severity due to its potential for Server-Side Request Forgery (SSRF) vulnerabilities.
How do I fix CVE-2025-32358?
To mitigate CVE-2025-32358, upgrade Zammad to version 6.4.2 or later, where the vulnerability has been patched.
Who is affected by CVE-2025-32358?
Authenticated admin users of Zammad versions 6.4.0 to 6.4.1 are affected by CVE-2025-32358.
What type of vulnerability is CVE-2025-32358?
CVE-2025-32358 is classified as a Server-Side Request Forgery (SSRF) vulnerability.
What are the implications of CVE-2025-32358?
Exploitation of CVE-2025-32358 can lead to unauthorized access to internal services and sensitive data through redirection.