« Volver al listado

CVE-2022-35487

Estado: ModificadaAlta (7.5)—

Zammad 5.2.0 suffers from Incorrect Access Control. Zammad did not correctly perform authorization on certain attachment endpoints. This could be abused by an unauthenticated attacker to gain access to attachments, such as emails or attached files.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Zammad — Zammad

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2022-35487",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2022-08-08T14:15:10.767",
  "references": [
    {
      "url": "https://zammad.com/de/advisories/zaa-2022-08",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://zammad.com/de/advisories/zaa-2022-08",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-863"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Zammad 5.2.0 suffers from Incorrect Access Control. Zammad did not correctly perform authorization on certain attachment endpoints. This could be abused by an unauthenticated attacker to gain access to attachments, such as emails or attached files."
    },
    {
      "lang": "es",
      "value": "Zammad versión 5.2.0, sufre un Control de Acceso Incorrecto. Zammad no llevaba a cabo correctamente la autorización en determinados extremos de los archivos adjuntos. Esto podría ser abusado por un atacante no autenticado para obtener acceso a los archivos adjuntos, tales como correos electrónicos o archivos adjuntos"
    }
  ],
  "lastModified": "2026-06-17T04:51:52.733",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:zammad:zammad:5.2.0:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D5C8C170-EEEC-40FE-AFFD-81B895F2765B"
            },
            {
              "criteria": "cpe:2.3:a:zammad:zammad:5.2.0:alpha:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "06BC0C3E-644D-42F6-B15D-B7DCB038F8A3"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}