CVE-2017-6080 An issue was discovered in Zammad before 1.0.4, 1.1.x before 1.1.3, and 1.2.x before 1.2.1, caused by lack of a protection mechanism involving HTTP Access-Control headers. To exploit the vulnerability...
CriticalCVSS 9.8
EPSS 0.73%
- Published
- Updated
- Exploit status
- No public exploit known
Description
An issue was discovered in Zammad before 1.0.4, 1.1.x before 1.1.3, and 1.2.x before 1.2.1, caused by lack of a protection mechanism involving HTTP Access-Control headers. To exploit the vulnerability, an attacker can send cross-domain requests directly to the REST API for users with a valid session cookie and receive the result.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| zammad | <= 1.0.3 | No fix listed |
| zammad | = 1.1.0 | No fix listed |
| zammad | = 1.1.1 | No fix listed |
| zammad | = 1.1.2 | No fix listed |
| zammad | = 1.2.0 | No fix listed |
References
- 96937 third-party-advisory vdb-entry
- zammad.com vendor-advisory