CVE-2024-33666

An issue was discovered in Zammad before 6.3.0. Users with customer access to a ticket could have accessed time accounting details of this ticket via the API. This data should be available only to agents.
References
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:zammad:zammad:*:*:*:*:*:*:*:*
cpe:2.3:a:zammad:zammad:6.3.0:alpha:*:*:*:*:*:*

History

15 Apr 2025, 16:40

Type Values Removed Values Added
CPE cpe:2.3:a:zammad:zammad:6.3.0:alpha:*:*:*:*:*:*
cpe:2.3:a:zammad:zammad:*:*:*:*:*:*:*:*
References () https://zammad.com/en/advisories/zaa-2024-01 - () https://zammad.com/en/advisories/zaa-2024-01 - Vendor Advisory
First Time Zammad
Zammad zammad

Information

Published : 2024-04-26 01:15

Updated : 2025-04-15 16:40


NVD link : CVE-2024-33666

Mitre link : CVE-2024-33666

CVE.ORG link : CVE-2024-33666


JSON object : View

Products Affected

zammad

  • zammad
CWE
CWE-284

Improper Access Control