CVE-2023-50454 Security feature bypass in n/a
Man-in-the-middle attackers can intercept or modify data exchanged between Zammad and external services due to missing SSL/TLS certificate validation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-50454?
CVE-2023-50454 is a medium-severity vulnerability in Zammad Zammad, published on 10 Dec 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered in Zammad before 6.2.0. In several subsystems, SSL/TLS was used to establish connections to external services without proper validation of hostname and certificate authority. This is exploitable by man-in-the-middle attackers.
Weakness: CWE-295
Which versions are affected by CVE-2023-50454?
It affects 1 product.
Products include Zammad Zammad.
How do I fix CVE-2023-50454?
No fix has been published for CVE-2023-50454 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-50454 being exploited?
There is no known exploitation of CVE-2023-50454 in the wild and no public exploit code.
Other vulnerabilities in Zammad Zammad
Sources
Also known as GHSA-xxf4-wg2g-58ch.