Zammad 6.1.0
Approved changes feed: RSS · Atom
cpe:2.3:a:zammad:zammad:6.1.0:-:*:*:*:*:*:*part: a version: 6.1.0 update: -
| Vendor | Zammad (c4a18e0f-7b9e-5129-8049-726b820feeed) |
|---|---|
| Product | Zammad (9e29b17c-6410-5005-8a60-aa1ce52c8044) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from NVD CPE 2.0 feed
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/zammad/zammad |
purl2cpe | 2026-06-01 10:16:54.958924 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2023-50457 |
vulnerable | 2026-06-08 06:16:16.210238 |
Details available
An issue was discovered in Zammad before 6.2.0. When listing tickets linked to a knowledge base answer, or knowledge base answers of a ticket, a user could see entries for which they lack permissions.
Published: 2023-12-10T00:00:00.000Z
Updated: 2024-08-02T22:16:46.817Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-50456 |
vulnerable | 2026-06-08 06:16:16.209806 |
Details available
An issue was discovered in Zammad before 6.2.0. An attacker can trigger phishing links in generated notification emails via a crafted first or last name.
Published: 2023-12-10T00:00:00.000Z
Updated: 2025-05-27T15:08:57.768Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-50455 |
vulnerable | 2026-06-08 06:16:16.209044 |
Details available
An issue was discovered in Zammad before 6.2.0. Due to lack of rate limiting in the "email address verification" feature, an attacker could send many requests for a known address to cause Denial Of Service (generation of many emails, which would also spam the victim).
Published: 2023-12-10T00:00:00.000Z
Updated: 2024-08-28T15:21:46.918Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-50454 |
vulnerable | 2026-06-08 06:16:16.208644 |
Details available
An issue was discovered in Zammad before 6.2.0. In several subsystems, SSL/TLS was used to establish connections to external services without proper validation of hostname and certificate authority. This is exploitable by man-in-the-middle attackers.
Published: 2023-12-10T00:00:00.000Z
Updated: 2024-08-02T22:16:46.864Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-50453 |
vulnerable | 2026-06-08 06:16:16.206863 |
Details available
An issue was discovered in Zammad before 6.2.0. It uses the public endpoint /api/v1/signshow for its login screen. This endpoint returns internal configuration data of user object attributes, such as selectable values, which should not be visible to the public.
Published: 2023-12-10T00:00:00.000Z
Updated: 2024-08-02T22:16:46.737Z Reference links |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.