CVE-2018-1000154

Zammad GmbH Zammad version 2.3.0 and earlier contains a Improper Neutralization of Script-Related HTML Tags in a Web Page (CWE-80) vulnerability in the subject of emails which are not html quoted in certain cases. This can result in the embedding and execution of java script code on users browser. This attack appear to be exploitable via the victim openning a ticket. This vulnerability appears to have been fixed in 2.3.1, 2.2.2 and 2.1.3.

CVSS v3 6.1 MEDIUM
CVSS v2.0 4.3 MEDIUM

6.1^/10

CVSS v3 : MEDIUM

Vector : AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

4.3^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
https://github.com/zammad/zammad/issues/1869	Third Party Advisory
https://zammad.com/news/release-2-4	Vendor Advisory
https://zammad.com/news/security-advisory-zaa-2018-01	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:zammad:zammad:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2018-04-05 13:29

Updated : 2023-12-10 12:30

NVD link : CVE-2018-1000154

Mitre link : CVE-2018-1000154

CVE.ORG link : CVE-2018-1000154

JSON object : View

Products Affected

zammad

zammad

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2018-1000154", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.0", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}]}, "published": "2018-04-05T13:29:00.950", "references": [{"url": "https://github.com/zammad/zammad/issues/1869", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://zammad.com/news/release-2-4", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://zammad.com/news/security-advisory-zaa-2018-01", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Zammad GmbH Zammad version 2.3.0 and earlier contains a Improper Neutralization of Script-Related HTML Tags in a Web Page (CWE-80) vulnerability in the subject of emails which are not html quoted in certain cases. This can result in the embedding and execution of java script code on users browser. This attack appear to be exploitable via the victim openning a ticket. This vulnerability appears to have been fixed in 2.3.1, 2.2.2 and 2.1.3."}, {"lang": "es", "value": "Las versiones 2.3.0 y anteriores de Zammad GmbH Zammad contienen una vulnerabilidad de neutralizaci\u00f3n incorrecta de etiquetas HTML relacionadas con scripts en una p\u00e1gina web (CWE-80) en el asunto de correos electr\u00f3nicos que no est\u00e1n entrecomillados por HTML en ciertos casos. Esto puede resultar en que se embebe y ejecuta c\u00f3digo JavaScript en el navegador de los usuarios. El ataque parece ser explotable mediante una v\u00edctima que abra un ticket. La vulnerabilidad parece haber sido solucionada en las versiones 2.3.1, 2.2.2 y 2.1.3."}], "lastModified": "2018-05-10T14:43:06.127", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:zammad:zammad:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6138034E-E6F1-4C71-AE28-7B419AE1D2EF", "versionEndIncluding": "2.3.0"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}