CVE-2017-6080
CriticalSummary
An issue was discovered in Zammad before 1.0.4, 1.1.x before 1.1.3, and 1.2.x before 1.2.1, caused by lack of a protection mechanism involving HTTP Access-Control headers. An attacker can send cross-domain requests directly to the REST API for users with a valid session cookie and receive the result.
Risk Assessment
The lack of proper protective headers may allow attackers to perform cross-site request forgery (CSRF) attacks, leading to unauthorized access to user data.
Recommendation
It is recommended to update Zammad to the latest version to implement appropriate protective mechanisms in the HTTP Access-Control headers.
Original NVD description (English source)
An issue was discovered in Zammad before 1.0.4, 1.1.x before 1.1.3, and 1.2.x before 1.2.1, caused by lack of a protection mechanism involving HTTP Access-Control headers. To exploit the vulnerability, an attacker can send cross-domain requests directly to the REST API for users with a valid session cookie and receive the result.