An issue was discovered in Zammad before 6.3.0. The Zammad Upload Cache uses insecure, partially guessable FormIDs to identify content. An attacker could try to brute force them to upload malicious c…
Critical CVSS 9.1
Summary
An issue was discovered in Zammad before 6.3.0. The Zammad Upload Cache uses insecure, partially guessable FormIDs to identify content. An attacker could try to brute force them to upload malicious content to article drafts they have no access to.
In-depth triage
No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).
Affected products
- :
Sources
- NVD DATABASE
Original Links
- https://a7.de/fue/advisories/cve-2024-33668/
- https://zammad.com/en/advisories/zaa-2024-02 Vendor Advisory
- https://zammad.com/en/advisories/zaa-2024-02 Vendor Advisory
Timeline
- nvd_ingest NVD