CVE-2025-32360: High severity zammad vulnerability

Q: What is the severity of CVE-2025-32360?

CVE-2025-32360 is considered a medium severity vulnerability due to potential information exposure.

Q: How do I fix CVE-2025-32360?

To fix CVE-2025-32360, upgrade Zammad to version 6.4.2 or later.

Q: What does CVE-2025-32360 expose?

CVE-2025-32360 exposes shared article draft details to logged-in customers, which may contain confidential information.

Q: Who is affected by CVE-2025-32360?

Zammad users running versions before 6.4.2 are affected by CVE-2025-32360.

Q: Is CVE-2025-32360 commonly exploited?

There is currently no evidence suggesting that CVE-2025-32360 is commonly exploited in the wild.

Published Apr 5, 2025

Updated

In Zammad 6.4.x before 6.4.2, there is information exposure. Only agents should be able to see and work on shared article drafts. However, a logged in customer was able to see details about shared drafts for their customer tickets in the browser console, which may contain confidential information, and also to manipulate them via API.

Affected Software

2 affected components

Zammad Zammad<6.4.2

Zammad Zammad>=6.4.0<6.4.2

Event History

Apr 5, 2025

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

DescriptionSeverityWeakness

Dec 11, 57260

Event

via FIRST·03:56 AM

Frequently Asked Questions

What is the severity of CVE-2025-32360?

CVE-2025-32360 is considered a medium severity vulnerability due to potential information exposure.

How do I fix CVE-2025-32360?

To fix CVE-2025-32360, upgrade Zammad to version 6.4.2 or later.

What does CVE-2025-32360 expose?

CVE-2025-32360 exposes shared article draft details to logged-in customers, which may contain confidential information.

Who is affected by CVE-2025-32360?

Zammad users running versions before 6.4.2 are affected by CVE-2025-32360.

Is CVE-2025-32360 commonly exploited?