CVE-2025-32359CWE-602

In Zammad 6.4.x before 6.4.2, there is client-side enforcement of server-side security

Medium · published April 5, 2025

CVSS v3.1
4.8
EPSS
0%
Percentile
21.2
In the wild
Unconfirmed
What it is

In Zammad 6.4.x before 6.4.2, there is client-side enforcement of server-side security. When changing their two factor authentication configuration, users need to re-authenticate with their current password first. However, this change was enforced in Zammad only on the front end level, and not when using the API directly.

The record
Technical detail
CVSS v3.1
4.8 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00297 · 21.2th percentile
Weakness
CWE-602 · Client-Side Enforcement of Server-Side Security
Published
2025-04-05T00:00Z
EPSS history
Timeline
  • 05 APR 00:00Z
    In Zammad 6.4.x before 6.4.2, there is client-side enforcement of server-side security
    cvelistv5