Vulnerability Description
An account-enumeration issue was discovered in Zammad before 3.4.1. The Create User functionality is implemented in a way that would enable an anonymous user to guess valid user email addresses. The application responds differently depending on whether the input supplied was recognized as associated with a valid user.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Zammad | Zammad | >= 1.0.0, < 3.4.1 |
References
- https://zammad.com/news/security-advisory-zaa-2020-14Vendor Advisory
- https://zammad.com/news/security-advisory-zaa-2020-14Vendor Advisory
FAQ
What is CVE-2020-26034?
CVE-2020-26034 is a vulnerability with a CVSS score of 4.3 (MEDIUM). An account-enumeration issue was discovered in Zammad before 3.4.1. The Create User functionality is implemented in a way that would enable an anonymous user to guess valid user email addresses. The a...
How severe is CVE-2020-26034?
CVE-2020-26034 has been rated MEDIUM with a CVSS base score of 4.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2020-26034?
Check the references section above for vendor advisories and patch information. Affected products include: Zammad Zammad.