CVE-2025-32358

In Zammad 6.4.x before 6.4.2, SSRF can occur. Authenticated admin users can enable webhooks in Zammad, which are triggered as POST requests when certain conditions are met. If a webhook endpoint returned a redirect response, Zammad would follow it automatically with another GET request. This could be abused by an attacker to cause GET requests for example in the local network.

CVSS v3 4.0 MEDIUM

4.0^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.2 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://zammad.com/en/advisories/zaa-2025-01	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:zammad:zammad:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2025-04-05 21:15

Updated : 2025-04-15 16:36

NVD link : CVE-2025-32358

Mitre link : CVE-2025-32358

CVE.ORG link : CVE-2025-32358

JSON object : View

Products Affected

zammad

zammad

CWE

CWE-918

Server-Side Request Forgery (SSRF)

{"id": "CVE-2025-32358", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "[email protected]", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 4.0, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.2}, {"type": "Primary", "source": "[email protected]", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 4.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.3}]}, "published": "2025-04-05T21:15:40.487", "references": [{"url": "https://zammad.com/en/advisories/zaa-2025-01", "tags": ["Vendor Advisory"], "source": "[email protected]"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-918"}]}, {"type": "Primary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-918"}]}], "descriptions": [{"lang": "en", "value": "In Zammad 6.4.x before 6.4.2, SSRF can occur. Authenticated admin users can enable webhooks in Zammad, which are triggered as POST requests when certain conditions are met. If a webhook endpoint returned a redirect response, Zammad would follow it automatically with another GET request. This could be abused by an attacker to cause GET requests for example in the local network."}, {"lang": "es", "value": "En Zammad 6.4.x anterior a 6.4.2, puede producirse una SSRF. Los usuarios administradores autenticados pueden habilitar webhooks en Zammad, que se activan como solicitudes POST cuando se cumplen ciertas condiciones. Si un punto final de un webhook devolv\u00eda una respuesta de redirecci\u00f3n, Zammad la segu\u00eda autom\u00e1ticamente con otra solicitud GET. Un atacante podr\u00eda aprovechar esto para generar solicitudes GET, por ejemplo, en la red local."}], "lastModified": "2025-04-15T16:36:06.817", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:zammad:zammad:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B3CB15F8-B4D0-450D-9D9A-9A710EE15BCB", "versionEndExcluding": "6.4.2", "versionStartIncluding": "6.4.0"}], "operator": "OR"}]}], "sourceIdentifier": "[email protected]"}