« Volver al listado

CVE-2023-50457

Estado: ModificadaMedia (4.3)—

An issue was discovered in Zammad before 6.2.0. When listing tickets linked to a knowledge base answer, or knowledge base answers of a ticket, a user could see entries for which they lack permissions.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Zammad — Zammad

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2023-50457",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 4.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2023-12-10T19:15:07.687",
  "references": [
    {
      "url": "https://zammad.com/en/advisories/zaa-2023-05",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://zammad.com/en/advisories/zaa-2023-05",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-863"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "An issue was discovered in Zammad before 6.2.0. When listing tickets linked to a knowledge base answer, or knowledge base answers of a ticket, a user could see entries for which they lack permissions."
    },
    {
      "lang": "es",
      "value": "Se descubrió un problema en Zammad antes de la versión 6.2.0. Al enumerar tickets vinculados a una respuesta de la base de conocimientos, o respuestas de la base de conocimientos de un ticket, un usuario podría ver entradas para las que carece de permisos."
    }
  ],
  "lastModified": "2026-06-17T06:39:40.297",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:zammad:zammad:6.1.0:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A246CC7D-8B52-43CC-A4F6-7E6C63D56740"
            },
            {
              "criteria": "cpe:2.3:a:zammad:zammad:6.1.0:alpha:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "226C3449-B353-4B93-AC0E-F9D6367FC962"
            },
            {
              "criteria": "cpe:2.3:a:zammad:zammad:6.2.0:alpha:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "98188727-1BBE-4691-8968-5E7047F19793"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}