CVE-2021-43145: Security Advisory ZAA-2021-20 | Zammad

Security Advisory

28. Oktober 2021 · Please read carefully and check if the version of your Zammad system is affected by this vulnerability. Please send us information regarding vulnerabilities in Zammad!

Security Advisory Details

• ID: ZAA-2021-20
• Date: 10/28/2021
• Title: Unauthorized Access
• Severity: high
• Product: Zammad 5.0.1
• Fixed in: Zammad 5.0.2
• References:
  –> [pending CVE assignment]

Vulnerability Descriptions****Unauthorized Access

With certain LDAP configurations, Zammad was found to be vulnerable to unauthorized access with existing user accounts.

Special 🙏 and 🤘 and ❤️ to:

• C: Deutscher Caritasverband e. V.
• W: https://www.caritas.de/

Recommended Resolution

This vulnerability is fixed in the latest versions of Zammad and it is recommended to upgrade to one of these.

Fixed releases can be found at:

• https://zammad.org/
• https://ftp.zammad.com/
  Or just update your Zammad if installed via OS package manager.

Additional information

Online version of this advisory: https://zammad.com/en/advisories/zaa-2021-20

Send all remarks to security issues to [email protected].