GCVE - cpe:2.3:a:zammad:zammad:1.1.2:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:zammad:zammad:1.1.2:*:*:*:*:*:*:*

part: a version: 1.1.2 update: *

Vendor	Zammad (`c4a18e0f-7b9e-5129-8049-726b820feeed`)
Product	Zammad (`9e29b17c-6410-5005-8a60-aa1ce52c8044`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*

Notes

Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:github/zammad/zammad`	purl2cpe	2026-06-01 10:16:54.944381

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2017-6081`	vulnerable	2026-06-08 05:09:50.501974	Details available A CSRF issue was discovered in Zammad before 1.0.4, 1.1.x before 1.1.3, and 1.2.x before 1.2.1. To exploit the vulnerability, an attacker can send cross-domain requests directly to the REST API for users with a valid session cookie. Published: 2017-03-13T06:14:00.000Z Updated: 2024-08-05T15:18:49.807Z Open on db.gcve.eu Reference links http://www.securityfocus.com/bid/96937 https://zammad.com/de/news/security-advisory-zaa-2017-01	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2017-6080`	vulnerable	2026-06-08 05:09:50.501563	Details available An issue was discovered in Zammad before 1.0.4, 1.1.x before 1.1.3, and 1.2.x before 1.2.1, caused by lack of a protection mechanism involving HTTP Access-Control headers. To exploit the vulnerability, an attacker can send cross-domain requests directly to the REST API for users with a valid session cookie and receive the result. Published: 2017-03-13T06:14:00.000Z Updated: 2024-08-05T15:18:49.685Z Open on db.gcve.eu Reference links http://www.securityfocus.com/bid/96937 https://zammad.com/de/news/security-advisory-zaa-2017-01	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2017-5621`	vulnerable	2026-06-08 05:09:47.367099	Details available An issue was discovered in Zammad before 1.0.4, 1.1.x before 1.1.3, and 1.2.x before 1.2.1. XSS can be triggered via malicious HTML in a chat message or the content of a ticket article, when using either the REST API or the WebSocket API. Published: 2017-03-13T06:14:00.000Z Updated: 2024-08-05T15:04:15.487Z Open on db.gcve.eu Reference links http://www.securityfocus.com/bid/96937 https://zammad.com/de/news/security-advisory-zaa-2017-01	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2017-5620`	vulnerable	2026-06-08 05:09:47.366700	Details available An XSS issue was discovered in Zammad before 1.0.4, 1.1.x before 1.1.3, and 1.2.x before 1.2.1. Attachments are opened in a new tab instead of getting downloaded. This creates an attack vector of executing code in the domain of the application. Published: 2017-03-13T06:14:00.000Z Updated: 2024-08-05T15:04:15.439Z Open on db.gcve.eu Reference links http://www.securityfocus.com/bid/96937 https://zammad.com/de/news/security-advisory-zaa-2017-01	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2017-5619`	vulnerable	2026-06-08 05:09:47.365721	Details available An issue was discovered in Zammad before 1.0.4, 1.1.x before 1.1.3, and 1.2.x before 1.2.1. Attackers can login with the hashed password itself (e.g., from the DB) instead of the valid password string. Published: 2017-03-13T06:14:00.000Z Updated: 2024-08-05T15:04:15.412Z Open on db.gcve.eu Reference links http://www.securityfocus.com/bid/96937 https://zammad.com/de/news/security-advisory-zaa-2017-01	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.

Zammad 1.1.2

Notes

PURL mappings

Vulnerability references

Contribute