CVE-2020-10100

{"id": "CVE-2020-10100", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N", "authentication": "SINGLE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "published": "2020-03-05T01:15:11.303", "references": [{"url": "https://zammad.com/news/security-advisory-zaa-2020-05", "tags": ["Patch", "Vendor Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered in Zammad 3.0 through 3.2. It allows for users to view ticket customer details associated with specific customers. However, the application does not properly implement access controls related to this functionality. As such, users of one company are able to access ticket data from other companies. Due to the multi-tenant nature of this application, users who can access ticket details from one organization to the next allows for users to exfiltrate potentially sensitive data of other companies."}, {"lang": "es", "value": "Se detect\u00f3 un problema en Zammad versiones 3.0 hasta 3.2. Permite a los usuarios visualizar los detalles de cliente del ticket asociados con clientes espec\u00edficos. Sin embargo, la aplicaci\u00f3n no implementa apropiadamente los controles de acceso relacionados con esta funcionalidad. Como tal, los usuarios de una compa\u00f1\u00eda son capaces de acceder a los datos de tickets de otras compa\u00f1\u00edas. Debido a la naturaleza multi-inquilino de esta aplicaci\u00f3n, los usuarios que pueden acceder a los detalles de los tickets de una organizaci\u00f3n a otra permiten a los usuarios extraer datos potencialmente confidenciales de otras compa\u00f1\u00edas."}], "lastModified": "2021-07-21T11:39:23.747", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:zammad:zammad:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3AD23B79-5882-4221-8D16-D332A1441814", "versionEndIncluding": "3.2.0", "versionStartIncluding": "1.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}