CVE-2025-32360

In Zammad 6.4.x before 6.4.2, there is information exposure. Only agents should be able to see and work on shared article drafts. However, a logged in customer was able to see details about shared drafts for their customer tickets in the browser console, which may contain confidential information, and also to manipulate them via API.

CVSS v3 4.2 MEDIUM

4.2^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.6 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://zammad.com/en/advisories/zaa-2025-03	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:zammad:zammad:*:*:*:*:*:*:*:*

History

15 Apr 2025, 15:25

Type	Values Removed	Values Added
CWE		NVD-CWE-Other
First Time		Zammad zammad Zammad
CPE		cpe:2.3:a:zammad:zammad::::::::
References	~~() https://zammad.com/en/advisories/zaa-2025-03 -~~	() https://zammad.com/en/advisories/zaa-2025-03 - Vendor Advisory

07 Apr 2025, 14:17

Type	Values Removed	Values Added
Summary		(es) En Zammad 6.4.x anterior a la 6.4.2, existe exposición de información. Solo los agentes deberían poder ver y trabajar en borradores de artículos compartidos. Sin embargo, un cliente conectado podía ver detalles sobre los borradores compartidos de sus tickets en la consola del navegador, que pueden contener información confidencial, y también manipularlos mediante la API.

05 Apr 2025, 21:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-04-05 21:15

Updated : 2025-04-15 15:25

NVD link : CVE-2025-32360

Mitre link : CVE-2025-32360

CVE.ORG link : CVE-2025-32360

JSON object : View

Products Affected

zammad

zammad

CWE

CWE-402

Transmission of Private Resources into a New Sphere ('Resource Leak')

NVD-CWE-Other

{"id": "CVE-2025-32360", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "cve@mitre.org", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.2, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 1.6}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 2.8}]}, "published": "2025-04-05T21:15:40.820", "references": [{"url": "https://zammad.com/en/advisories/zaa-2025-03", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "cve@mitre.org", "description": [{"lang": "en", "value": "CWE-402"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "In Zammad 6.4.x before 6.4.2, there is information exposure. Only agents should be able to see and work on shared article drafts. However, a logged in customer was able to see details about shared drafts for their customer tickets in the browser console, which may contain confidential information, and also to manipulate them via API."}, {"lang": "es", "value": "En Zammad 6.4.x anterior a la 6.4.2, existe exposici\u00f3n de informaci\u00f3n. Solo los agentes deber\u00edan poder ver y trabajar en borradores de art\u00edculos compartidos. Sin embargo, un cliente conectado pod\u00eda ver detalles sobre los borradores compartidos de sus tickets en la consola del navegador, que pueden contener informaci\u00f3n confidencial, y tambi\u00e9n manipularlos mediante la API."}], "lastModified": "2025-04-15T15:25:12.600", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:zammad:zammad:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B3CB15F8-B4D0-450D-9D9A-9A710EE15BCB", "versionEndExcluding": "6.4.2", "versionStartIncluding": "6.4.0"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}