VULNERABILITY INTELLIGENCE

CVE-2024-33668

CVSS score9.1 CRITICAL
EPSS probability0.45%
CISA KEVNot currently listed
Published2024-04-26
Last modified2026-09-16
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Description

An issue was discovered in Zammad before 6.3.0. The Zammad Upload Cache uses insecure, partially guessable FormIDs to identify content. An attacker could try to brute force them to upload malicious content to article drafts they have no access to.

Weakness classification

  • CWE-639: Authorization Bypass Through User-Controlled Key

Primary references