CVE-2025-32360
CVSS 3.1 Score 8.1 of 10 (high)
Details
Published Apr 5, 2025
Updated: Apr 15, 2025
CWE ID 402
Summary
CVE-2025-32360 is a vulnerability affecting Zammad version 6.4.x prior to 6.4.2. This issue permits logged-in customers to access sensitive information about shared article drafts for their customer tickets through the browser console. These drafts could contain confidential data. Additionally, customers are able to manipulate these drafts via the API, raising security concerns. Agents were intended to be the only users with access to shared drafts.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Affected Vendors
- Zammad