CVE-2023-31597

An issue in Zammad v5.4.0 allows attackers to bypass e-mail verification using an arbitrary address and manipulate the data of the generated user

Medium · published May 18, 2023

CVSS v3.1
6.5
EPSS
0%
Percentile
35.7
In the wild
Unconfirmed
What it is

An issue in Zammad v5.4.0 allows attackers to bypass e-mail verification using an arbitrary address and manipulate the data of the generated user. Attackers are also able to gain unauthorized access to existing tickets.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00425 · 35.7th percentile
Published
2023-05-18T00:00Z
EPSS history
Timeline
  • 18 MAY 00:00Z
    An issue in Zammad v5.4.0 allows attackers to bypass e-mail verification using an arbitrary address and manipulate the data of the generated user
    cvelistv5