« Volver al listado

CVE-2023-50453

Estado: ModificadaMedia (5.3)—

An issue was discovered in Zammad before 6.2.0. It uses the public endpoint /api/v1/signshow for its login screen. This endpoint returns internal configuration data of user object attributes, such as selectable values, which should not be visible to the public.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Zammad — Zammad

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2023-50453",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2023-12-10T19:15:07.480",
  "references": [
    {
      "url": "https://zammad.com/en/advisories/zaa-2023-08",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://zammad.com/en/advisories/zaa-2023-08",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "An issue was discovered in Zammad before 6.2.0. It uses the public endpoint /api/v1/signshow for its login screen. This endpoint returns internal configuration data of user object attributes, such as selectable values, which should not be visible to the public."
    },
    {
      "lang": "es",
      "value": "Se descubrió un problema en Zammad antes de la versión 6.2.0. Utiliza el endpoint público /api/v1/signshow para su pantalla de inicio de sesión. Este endpoint devuelve datos de configuración interna de los atributos del objeto del usuario, como valores seleccionables, que no deberían ser visibles para el público."
    }
  ],
  "lastModified": "2026-06-17T06:39:39.667",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:zammad:zammad:6.1.0:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A246CC7D-8B52-43CC-A4F6-7E6C63D56740"
            },
            {
              "criteria": "cpe:2.3:a:zammad:zammad:6.1.0:alpha:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "226C3449-B353-4B93-AC0E-F9D6367FC962"
            },
            {
              "criteria": "cpe:2.3:a:zammad:zammad:6.2.0:alpha:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "98188727-1BBE-4691-8968-5E7047F19793"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}