« Volver al listado

CVE-2024-33666

Estado: AnalizadaAlta (8.6)—

An issue was discovered in Zammad before 6.3.0. Users with customer access to a ticket could have accessed time accounting details of this ticket via the API. This data should be available only to agents.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Zammad — Zammad

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-33666",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-33666",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-05-01T17:07:59.203892Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.6,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "LOW",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 4.7,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:Zimmad:Zimmad:*:*:*:*:*:*:*:*"
          ],
          "vendor": "Zimmad",
          "product": "Zimmad",
          "versions": [
            {
              "status": "affected",
              "version": "*"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2024-04-26T01:15:46.190",
  "references": [
    {
      "url": "https://zammad.com/en/advisories/zaa-2024-01",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://zammad.com/en/advisories/zaa-2024-01",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "description": [
        {
          "lang": "en",
          "value": "CWE-284"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "An issue was discovered in Zammad before 6.3.0. Users with customer access to a ticket could have accessed time accounting details of this ticket via the API. This data should be available only to agents."
    },
    {
      "lang": "es",
      "value": "Se descubrió un problema en Zammad antes de la versión 6.3.0. Los usuarios con acceso de cliente a un ticket podrían haber accedido a los detalles de contabilidad de tiempo de este ticket a través de la API. Estos datos deben estar disponibles sólo para los agentes."
    }
  ],
  "lastModified": "2026-06-17T07:32:11.793",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:zammad:zammad:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E5E2015B-6D7D-4369-BDE2-06E48632B741",
              "versionEndExcluding": "6.3.0",
              "versionStartIncluding": "6.2.0"
            },
            {
              "criteria": "cpe:2.3:a:zammad:zammad:6.3.0:alpha:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EB556B18-88A9-48C9-BA1B-D49B75E4A844"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}