Information disclosure in Zammad
CVE-2020-10096
An issue was discovered in Zammad 3.0 through 3.2. It does not prevent caching of confidential data within browser memory. An attacker who either remotely compromises or obtains physical access to a user's workstation can browse the browser cache contents and obtain sensitive information. The attacker does not need to be authenticated with the application to view this information, as it would be available via the browser cache.
Vulnerability class: Information Disclosure
EPSS: 0.011 (63.3th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.
Affected products
- Zammad
- N/a — versions n/a
Weakness classification (CWE)
References
- cve@mitre.org (Patch, x_refsource_MISC, Vendor Advisory)
Frequently asked questions
- What is CVE-2020-10096?
- CVE-2020-10096 is a high-severity vulnerability in Zammad, classified under Information Disclosure. CVSS score: 7.5/10. Published 2020-03-05.
- How severe is CVE-2020-10096?
- High severity. CVSS v3 base score is 7.5 out of 10.