Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, the legacy destroy_form action on AttachmentsController deletes UploadCache Store records based solely on a user-supplied form_id without verifying that the requesting user owns those records. An authenticated attacker who learns another user's pending-upload UUID can silently remove temporary file uploads before the victim submits their ticket or article.
This issue is fixed in version 7.1.2.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
High
Difficult to exploit
Attack Requirements
None
No additional conditions
Privileges Required
Low
Basic privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
None
No data leak
Integrity
Low
Partial data modification
Availability
Low
Partial disruption
CVSS Vector v4.0
Weakness Type (CWE)
Vulnerable Products
zammad:zammad
References 2
https://github.com/zammad/zammad/security/advisories/GHSA-x4f3-367g-m93g
https://github.com/zammad/zammad/security/advisories/GHSA-x4f3-367g-m93g
https://github.com/zammad/zammad/commit/3b755736fdbee8ff6ddf53661d6912d3d3028325
https://github.com/zammad/zammad/commit/3b755736fdbee8ff6ddf53661d6912d3d3028325