CVE-2022-27331

EUVD-2022-31835
An access control issue in Zammad v5.0.3 broadcasts administrative configuration changes to all users who have an active application instance, including settings that should only be visible to authenticated users.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
4.3 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 48%
Affected Products (NVD)
VendorProductVersion
zammadzammad
𝑥
< 5.1.0
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://zammad.com/de/advisories/zaa-2022-02
https://zammad.com/de/advisories/zaa-2022-02