Zammad vulnerabilities

A CSRF issue was discovered in Zammad before 1.0.4, 1.1.x before 1.1.3, and 1.2.x before 1.2.1. An attacker can exploit this vulnerability by sending cross-domain requests directly to the REST API for users with a valid session cookie.

An issue was discovered in Zammad before 1.0.4, 1.1.x before 1.1.3, and 1.2.x before 1.2.1, caused by lack of a protection mechanism involving HTTP Access-Control headers. An attacker can send cross-domain requests directly to the REST API for users with a valid session cookie and receive the result.

An issue was discovered in Zammad before 1.0.4, 1.1.x before 1.1.3, and 1.2.x before 1.2.1 that allows attackers to login using the hashed password instead of the valid password string.

Zammad 7.1.0 contains an authenticated improper authorization vulnerability in the ticket article attachment cloning endpoint.

Zammad prior to version 7.0.1 contains an authorization failure in the REST endpoint POST /api/v1/ai_assistance/text_tools/:id. Context data (e.g., a group or organization) supplied for use in the AI prompt were not checked for accessibility by the current user, leading to unauthorized data being used in the prompt.

In Zammad, a web-based open source helpdesk system, prior to versions 7.0.1 and 6.5.4, the REST endpoint POST /api/v1/ai_assistance/text_tools/:id did not check if a user is privileged to use the text tool, allowing its use in all situations without proper authorization.

Zammad before version 7.0.1 has a server-side template injection (SSTI) vulnerability leading to remote code execution (RCE) via the AI Agent. Impact is limited to environments where an attacker can control type_enrichment_data (typically high-privilege administrative configuration).

Zammad before versions 7.0.1 and 6.5.4 allows unauthenticated attackers to access the 'getting started' endpoint, which exposes sensitive internal entity data even after system setup is complete.

In Zammad, a web-based open source helpdesk system, prior to versions 7.0.1 and 6.5.4, the endpoint used for ticket creation was missing authorization when the parameter for adding links was used, allowing unauthorized ticket creation with links.

CSRF vulnerability in Zammad prior to 7.0.1 and 6.5.4. OAuth callback endpoints for Microsoft, Google, and Facebook do not validate a CSRF state parameter.

SSO mechanism vulnerability in Zammad prior to 7.0.1 and 6.5.4. The system did not verify the header originates from a trusted SSO proxy/gateway before applying actions.

Zammad, a web-based open source helpdesk/customer support system, prior to versions 7.0.1 and 6.5.4, had a vulnerability in the webhook model that lacked proper validation for loopback or link-local addresses. Only the URL scheme (HTTP/HTTPS) and hostname were checked, potentially leading to disclosure of confidential cloud/hosting metadata. The fix extends validation both when configuring webhooks and triggering webhook jobs.

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1 and 6.5.4, the HTML sanitizer for ticket articles was missing proper sanitization of data: ... URI schemes, resulting in storing such malicious content in the database. The Zammad GUI renders this content, but due to CSP rules no harm was done by clicking such a link. Fixed in 7.0.1 and 6.5.4.

Zammad prior to version 7.0.1 allows customers in shared organizations (who can see each other's tickets) to view fields not intended for customers, including internal fields (e.g., priority, custom attributes). This occurs when a customer opens a ticket from another user in the same organization. Customers cannot modify these fields.