CVE-2022-35488

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

In Zammad 5.2.0, an attacker could manipulate the rate limiting in the 'forgot password' feature of Zammad, and thereby send many requests for a known account to cause Denial Of Service by many generated emails which would also spam the victim.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected software

No affected versions have been published.

Timeline

Published
Aug 8, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-354896.5In Zammad 5.2.0, customers who have secondary organizations assigned were able to see all organizations of the system rather than only thoseCVE-2022-35497.2A vulnerability was found in SourceCodester Simple Cold Storage Management System 1.0. It has been rated as problematic. This issue affects CVE-2022-354909.8Zammad 5.2.0 is vulnerable to privilege escalation. Zammad has a prevention against brute-force attacks trying to guess login credentials. ACVE-2022-354919.8TOTOLINK A3002RU V3.0.0-B20220304.1804 has a hardcoded password for root in /etc/shadow.sample.CVE-2022-354936.1A Cross-site scripting (XSS) vulnerability in json search parse and the json response in wrteam.in, eShop - Multipurpose Ecommerce Store WebCVE-2022-354975.4In Trimble TM4WEB 21.4.0.4 due to security misconfiguration with session identifiers, it is possible to recover valid session cookies via reCVE-2022-354997.1In Trimble TM4WEB 21.4.0.4, the external bill viewer endpoint is vulnerable to reflected cross-site scripting via injection in a arbitrary pCVE-2022-35508.8A vulnerability classified as critical was found in X.org Server. Affected by this vulnerability is the function _GetCountedString of the fiCVE-2022-355005.4Amasty Blog 2.10.3 is vulnerable to Cross Site Scripting (XSS) via leave comment functionality.CVE-2022-355015.4Stored Cross-site Scripting (XSS) exists in the Amasty Blog Pro 2.10.3 and 2.10.4 plugin for Magento 2 because of the duplicate post functioCVE-2022-355037.5Improper verification of a user input in Open Source MANO v7-v12 allows an authenticated attacker to execute arbitrary code within the LCM mCVE-2022-355057.5A segmentation fault in TripleCross v0.1.0 occurs when sending a control command from the client to the server. This occurs because there is
CVE-2022-35488: High severity, CVSS 7.5 | Vulnix