CVE-2025-32360

HIGH Year: 2025
CVSS v3 Score
8.1
High
Weakness Type
CWE-402
View all →

Vulnerability Description

In Zammad 6.4.x before 6.4.2, there is information exposure. Only agents should be able to see and work on shared article drafts. However, a logged in customer was able to see details about shared drafts for their customer tickets in the browser console, which may contain confidential information, and also to manipulate them via API.

Related Vulnerabilities

CVE-2025-48383

HIGH
CVSS:8.2(High)

Django-Select2 is a Django integration for Select2. Prior to version 8.4.1, instances of HeavySelect2Mixin subclasses like the ModelSelect2MultipleWidget and ModelSelect2Widget can leak secret access ...

CWE-4022025

CVE-2021-23263

HIGH
CVSS:7.5(High)

Unauthenticated remote attackers can read textual content via FreeMarker including files /scripts/*, /templates/* and some of the files in /.git/* (non-binary).

CWE-4022021

CVE-2021-31407

HIGH
CVSS:7.5(High)

Vulnerability in OSGi integration in com.vaadin:flow-server versions 1.2.0 through 2.4.7 (Vaadin 12.0.0 through 14.4.9), and 6.0.0 through 6.0.1 (Vaadin 19.0.0) allows attacker to access application c...

CWE-4022021

CVE-2021-31410

HIGH
CVSS:7.5(High)

Overly relaxed configuration of frontend resources server in Vaadin Designer versions 4.3.0 through 4.6.3 allows remote attackers to access project sources via crafted HTTP request.

CWE-4022021

CVE-2022-3596

HIGH
CVSS:7.5(High)

An information leak was found in OpenStack's undercloud. This flaw allows unauthenticated, remote attackers to inspect sensitive data after discovering the IP address of the undercloud, possibly leadi...

CWE-4022022

CVE-2023-34467

HIGH
CVSS:7.5(High)

XWiki Platform is a generic wiki platform. Starting in version 3.5-milestone-1 and prior to versions 14.4.8, 14.10.4, and 15.0-rc-1, the mail obfuscation configuration was not fully taken into account...

CWE-4022023