CVE-2025-32358CWE-918

In Zammad 6.4.x before 6.4.2, SSRF can occur

Medium · published April 5, 2025

CVSS v3.1
4.0
EPSS
0%
Percentile
18.6
In the wild
Unconfirmed
What it is

In Zammad 6.4.x before 6.4.2, SSRF can occur. Authenticated admin users can enable webhooks in Zammad, which are triggered as POST requests when certain conditions are met. If a webhook endpoint returned a redirect response, Zammad would follow it automatically with another GET request. This could be abused by an attacker to cause GET requests for example in the local network.

The record
Technical detail
CVSS v3.1
4.0 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00272 · 18.6th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2025-04-05T00:00Z
EPSS history
Timeline
  • 05 APR 00:00Z
    In Zammad 6.4.x before 6.4.2, SSRF can occur
    cvelistv5