PT-2020-11929
CVE-2020-10105
·
تاريخ النشر
2020-03-05
·
تاريخ التحديث
2021-07-21
الوصف من
CVSS 3.1
5.3
متوسطةالمقاييسAV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Name of the Vulnerable Software and Affected Versions
Zammad versions 3.0 through 3.2
Description
An issue was discovered where submitting an OPTIONS request returns the source code of static resources, instead of a GET request. This disclosure of source code allows an attacker to formulate more precise attacks. Specifically, the source code was disclosed for the file 404.html, located at /zammad/public/404.html.
Recommendations
For Zammad versions 3.0 through 3.2, consider restricting access to the /zammad/public/404.html file until a patch is available.
As a temporary workaround, avoid using the OPTIONS request method for static resources until the issue is resolved.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾