CVE-2025-32357

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-32357
In Zammad 6.4.x before 6.4.2, an authenticated agent with knowledge base permissions was able to use the Zammad API to fetch knowledge base content that they have no permission for.

4.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://zammad.com/en/advisories/zaa-2025-04 Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:zammad:zammad:*:*:*:*:*:*:*:*
History

15 Apr 2025, 16:37

Type Values Removed Values Added
References () https://zammad.com/en/advisories/zaa-2025-04 - () https://zammad.com/en/advisories/zaa-2025-04 - Vendor Advisory
First Time Zammad
Zammad zammad
CWE CWE-306
CPE cpe:2.3:a:zammad:zammad:*:*:*:*:*:*:*:*

07 Apr 2025, 14:17

Type Values Removed Values Added
Summary
  • (es) En Zammad 6.4.x anterior a 6.4.2, un agente autenticado con permisos de base de conocimientos podía usar la API de Zammad para obtener contenido de la base de conocimientos para el que no tenía permiso.

05 Apr 2025, 21:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-04-05 21:15

Updated : 2025-04-15 16:37

NVD link : CVE-2025-32357

Mitre link : CVE-2025-32357

CVE.ORG link : CVE-2025-32357

JSON object : View

Products Affected

zammad

  • zammad
CWE
CWE-288

Authentication Bypass Using an Alternate Path or Channel

CWE-306

Missing Authentication for Critical Function