1. Home
  2. CVE Database
  3. CVE-2022-40817
MEDIUM · 4.3

CVE-2022-40817

Zammad 5.2.1 has a fine-grained permission model that allows to configure read-only access to tickets. However, agents were still wrongly able to perform some operations on such tickets, like adding a...

Vulnerability Description

Zammad 5.2.1 has a fine-grained permission model that allows to configure read-only access to tickets. However, agents were still wrongly able to perform some operations on such tickets, like adding and removing links, tags. and related answers. This issue has been fixed in 5.2.2.

CVSS Score

4.3

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
NONE
Integrity
LOW
Availability
NONE

Affected Products

VendorProductVersions
ZammadZammad>= 5.2.0, < 5.2.2

Related Weaknesses (CWE)

CWE-732

References

FAQ

What is CVE-2022-40817?

CVE-2022-40817 is a vulnerability with a CVSS score of 4.3 (MEDIUM). Zammad 5.2.1 has a fine-grained permission model that allows to configure read-only access to tickets. However, agents were still wrongly able to perform some operations on such tickets, like adding a...

How severe is CVE-2022-40817?

CVE-2022-40817 has been rated MEDIUM with a CVSS base score of 4.3/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2022-40817?

Check the references section above for vendor advisories and patch information. Affected products include: Zammad Zammad.