by Kastro
Paper/Archive/CVE-2024-33668

CVE-2024-33668

zammad zammad — An issue was discovered in Zammad before 6.3.0.

EPSS 0.4%public exploitCVSS 9.1
critical.is priorityof 100
45
CVSS 9.1 (ADP)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 38.9.389 × 207.8Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

An issue was discovered in Zammad before 6.3.0. The Zammad Upload Cache uses insecure, partially guessable FormIDs to identify content. An attacker could try to brute force them to upload malicious content to article drafts they have no access to.

Affected

ProductAffectedFixed inSource
n/an/a–CNA
zammad6.2.0 – < 6.3.06.3.0CISA-ADP

Scores by source

CISA ADP9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

refzammad.com/en/advisories/zaa-2024-02refa7.de/fue/advisories/cve-2024-33668