Zammad 5.2.0
Approved changes feed: RSS · Atom
cpe:2.3:a:zammad:zammad:5.2.0:-:*:*:*:*:*:*part: a version: 5.2.0 update: -
| Vendor | Zammad (c4a18e0f-7b9e-5129-8049-726b820feeed) |
|---|---|
| Product | Zammad (9e29b17c-6410-5005-8a60-aa1ce52c8044) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from NVD CPE 2.0 feed
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/zammad/zammad |
purl2cpe | 2026-06-01 10:16:54.956435 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2022-35490 |
vulnerable | 2026-06-08 05:46:04.923100 |
Details available
Zammad 5.2.0 is vulnerable to privilege escalation. Zammad has a prevention against brute-force attacks trying to guess login credentials. After a configurable amount of attempts, users are invalidated and logins prevented. An attacker might work around this prevention, enabling them to send more than the configured amount of requests before the user invalidation takes place.
Published: 2022-08-08T13:58:33.000Z
Updated: 2024-08-03T09:36:44.267Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-35489 |
vulnerable | 2026-06-08 05:46:04.922799 |
Details available
In Zammad 5.2.0, customers who have secondary organizations assigned were able to see all organizations of the system rather than only those to which they are assigned.
Published: 2022-08-08T13:55:30.000Z
Updated: 2024-08-03T09:36:44.111Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-35488 |
vulnerable | 2026-06-08 05:46:04.922375 |
Details available
In Zammad 5.2.0, an attacker could manipulate the rate limiting in the 'forgot password' feature of Zammad, and thereby send many requests for a known account to cause Denial Of Service by many generated emails which would also spam the victim.
Published: 2022-08-08T13:53:34.000Z
Updated: 2024-08-03T09:36:44.120Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-35487 |
vulnerable | 2026-06-08 05:46:04.921198 |
Details available
Zammad 5.2.0 suffers from Incorrect Access Control. Zammad did not correctly perform authorization on certain attachment endpoints. This could be abused by an unauthenticated attacker to gain access to attachments, such as emails or attached files.
Published: 2022-08-08T13:51:36.000Z
Updated: 2024-08-03T09:36:44.101Z Reference links |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.