CVE-2024-36078 Code injection in n/a
A local attacker can modify world-writable Ruby gem files to inject arbitrary code into Zammad processes, leading to code execution and privilege escalation.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-36078?
CVE-2024-36078 is a medium-severity code injection vulnerability in Zammad Zammad, published on 19 May 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In Zammad before 6.3.1, a Ruby gem bundled by Zammad is installed with world-writable file permissions. This allowed a local attacker on the server to modify the gem's files, injecting arbitrary code into Zammad processes (which run with the environment and permissions of the Zammad user).
Weakness: CWE-94
Which versions are affected by CVE-2024-36078?
It affects 1 product.
Products include Zammad Zammad.
How do I fix CVE-2024-36078?
No fix has been published for CVE-2024-36078 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2024-36078 being exploited?
There is no known exploitation of CVE-2024-36078 in the wild and no public exploit code.
Other vulnerabilities in Zammad Zammad
Sources
Also known as GHSA-999v-p9fh-4w86.