CVE-2022-48023

{"id": "CVE-2022-48023", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "published": "2023-02-03T01:15:13.527", "references": [{"url": "https://zammad.com/de/advisories/zaa-2022-12", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://zammad.com/de/advisories/zaa-2022-12", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "Insufficient privilege verification in Zammad v5.3.0 allows an authenticated attacker to perform changes on the tags of their customer tickets using the Zammad API. This is now corrected in v5.3.1 so that only agents with write permissions may change ticket tags."}, {"lang": "es", "value": "La verificaci\u00f3n de privilegios insuficiente en Zammad v5.3.0 permite a un atacante autenticado realizar cambios en las etiquetas de los tickets de sus clientes utilizando la API de Zammad. Esto ahora se corrigi\u00f3 en la versi\u00f3n 5.3.1 para que solo los agentes con permisos de escritura puedan cambiar las etiquetas de los tickets."}], "lastModified": "2024-11-21T07:32:45.350", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:zammad:zammad:5.3.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "673641B9-567C-4E84-9405-CA81BC7E2539"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}