CVE-2023-50454

Name of the Vulnerable Software and Affected Versions Zammad versions prior to 6.2.0

Description An issue was discovered in several subsystems where SSL/TLS was used to establish connections to external services without proper validation of hostname and certificate authority. This is exploitable by man-in-the-middle attackers.

Recommendations For versions prior to 6.2.0, update to version 6.2.0 or later to resolve the issue. As a temporary workaround, consider restricting access to external services until a patch is applied. Avoid using SSL/TLS connections to external services without proper validation of hostname and certificate authority until the issue is resolved.