ByteOS Network

NVD Vulnerability Details :

CVE-2025-32359

Analyzed

Source-cve@mitre.org

Published At-05 Apr, 2025 | 21:15

Updated At-15 Apr, 2025 | 15:31

In Zammad 6.4.x before 6.4.2, there is client-side enforcement of server-side security. When changing their two factor authentication configuration, users need to re-authenticate with their current password first. However, this change was enforced in Zammad only on the front end level, and not when using the API directly.

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Secondary	3.1	4.8	MEDIUM	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Primary	3.1	8.8	HIGH	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Type: Secondary

Version: 3.1

Base score: 4.8

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Type: Primary

Version: 3.1

Base score: 8.8

Base severity: HIGH

Vector:

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CPE Matches

zammad>>zammad>>Versions from 6.4.0(inclusive) to 6.4.2(exclusive)

cpe:2.3:a:zammad:zammad:*:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-602	Secondary	cve@mitre.org
NVD-CWE-Other	Primary	nvd@nist.gov

CWE ID: CWE-602

Type: Secondary

Source: cve@mitre.org

CWE ID: NVD-CWE-Other

Type: Primary

Source: nvd@nist.gov

References

Hyperlink	Source	Resource
https://zammad.com/en/advisories/zaa-2025-02	cve@mitre.org	Vendor Advisory

Hyperlink: https://zammad.com/en/advisories/zaa-2025-02

Source: cve@mitre.org

Resource:

Vendor Advisory

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History