CVE-2020-14214

Zammad before 3.3.1, when Domain Based Assignment is enabled, relies on a claimed e-mail address for authorization decisions

published June 16, 2020

CVSS
—
EPSS
1%
Percentile
53.3
In the wild
Unconfirmed
What it is

Zammad before 3.3.1, when Domain Based Assignment is enabled, relies on a claimed e-mail address for authorization decisions. An attacker can register a new account that will have access to all tickets of an arbitrary Organization.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00717 · 53.3th percentile
Published
2020-06-16T22:22Z
EPSS history
Timeline
  • 16 JUN 22:22Z
    Zammad before 3.3.1, when Domain Based Assignment is enabled, relies on a claimed e-mail address for authorization decisions
    cvelistv5