CVE-2022-35487

{"id": "CVE-2022-35487", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2022-08-08T14:15:10.767", "references": [{"url": "https://zammad.com/de/advisories/zaa-2022-08", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://zammad.com/de/advisories/zaa-2022-08", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "Zammad 5.2.0 suffers from Incorrect Access Control. Zammad did not correctly perform authorization on certain attachment endpoints. This could be abused by an unauthenticated attacker to gain access to attachments, such as emails or attached files."}, {"lang": "es", "value": "Zammad versi\u00f3n 5.2.0, sufre un Control de Acceso Incorrecto. Zammad no llevaba a cabo correctamente la autorizaci\u00f3n en determinados extremos de los archivos adjuntos. Esto podr\u00eda ser abusado por un atacante no autenticado para obtener acceso a los archivos adjuntos, tales como correos electr\u00f3nicos o archivos adjuntos"}], "lastModified": "2024-11-21T07:11:14.297", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:zammad:zammad:5.2.0:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D5C8C170-EEEC-40FE-AFFD-81B895F2765B"}, {"criteria": "cpe:2.3:a:zammad:zammad:5.2.0:alpha:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "06BC0C3E-644D-42F6-B15D-B7DCB038F8A3"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}