{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:zammad:zammad:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "113864CB-718D-4B62-BD84-587A1DE8ED19",
              "versionEndIncluding": "1.0.3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:zammad:zammad:1.1.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "7349B6BD-C108-4120-BD42-7FD3B39E46DA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:zammad:zammad:1.1.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "F9F1D9BF-4A1B-4C55-89FE-AE174BD9994D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:zammad:zammad:1.1.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "327D5DB8-7B7E-4BFA-8329-28BEB3BCE6C6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:zammad:zammad:1.2.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "6A5511A6-864E-4069-951C-A0E0C38C6655",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "An issue was discovered in Zammad before 1.0.4, 1.1.x before 1.1.3, and 1.2.x before 1.2.1. Attackers can login with the hashed password itself (e.g., from the DB) instead of the valid password string."
    },
    {
      "lang": "es",
      "value": "Se ha descubierto un problema en Zammad en versiones anteriores a 1.0.4, 1.1.x en versiones anteriores a 1.1.3 y 1.2.x en versiones anteriores a 1.2.1. Atacantes pueden iniciar sesi\u00f3n con la contrase\u00f1a hash por s\u00ed misma (por ejemplo desde el DB) en lugar de con la cadena de contrase\u00f1a v\u00e1lida."
    }
  ],
  "id": "CVE-2017-5619",
  "lastModified": "2025-04-20T01:37:25.860",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 7.5,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.0"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2017-03-13T06:59:00.293",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "http://www.securityfocus.com/bid/96937"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://zammad.com/de/news/security-advisory-zaa-2017-01"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "http://www.securityfocus.com/bid/96937"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://zammad.com/de/news/security-advisory-zaa-2017-01"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-287"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}