What is CVE-2022-27332?

CVE-2022-27332 is a critical-severity vulnerability in Zammad, classified under Missing Authentication for Critical Function. CVSS score: 9.1/10. Published 2022-04-27.

How severe is CVE-2022-27332?

Critical severity. CVSS v3 base score is 9.1 out of 10.

Auth bypass in Zammad

CVE-2022-27332

An access control issue in Zammad v5.0.3 allows attackers to write entries to the CTI caller log without authentication. This vulnerability can allow attackers to execute phishing attacks or cause a Denial of Service (DoS).

Vulnerability class: Broken Authentication

EPSS: 0.010 (60.7th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.1 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H.

Affected products

Zammad
N/a — versions n/a

Weakness classification (CWE)

CWE-306 — Missing Authentication for Critical Function

References

cve@mitre.org (Patch, x_refsource_MISC, Vendor Advisory)

Frequently asked questions

What is CVE-2022-27332?: CVE-2022-27332 is a critical-severity vulnerability in Zammad, classified under Missing Authentication for Critical Function. CVSS score: 9.1/10. Published 2022-04-27.
How severe is CVE-2022-27332?: Critical severity. CVSS v3 base score is 9.1 out of 10.