CVE-2025-32360CWE-402

In Zammad 6.4.x before 6.4.2, there is information exposure

Medium · published April 5, 2025

CVSS v3.1
4.2
EPSS
0%
Percentile
15.8
In the wild
Unconfirmed
What it is

In Zammad 6.4.x before 6.4.2, there is information exposure. Only agents should be able to see and work on shared article drafts. However, a logged in customer was able to see details about shared drafts for their customer tickets in the browser console, which may contain confidential information, and also to manipulate them via API.

The record
Technical detail
CVSS v3.1
4.2 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00253 · 15.8th percentile
Weakness
CWE-402 · Transmission of Private Resources into a New Sphere ('Resource Leak')
Published
2025-04-05T00:00Z
EPSS history
Timeline
  • 05 APR 00:00Z
    In Zammad 6.4.x before 6.4.2, there is information exposure
    cvelistv5