CVE-2022-48023

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

Insufficient privilege verification in Zammad v5.3.0 allows an authenticated attacker to perform changes on the tags of their customer tickets using the Zammad API. This is now corrected in v5.3.1 so that only agents with write permissions may change ticket tags.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Affected software

No affected versions have been published.

Timeline

Published
Feb 3, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-48038.8Authorization Bypass Through User-Controlled Key in GitHub repository usememos/memos prior to 0.9.1.CVE-2022-48045.3Improper Authorization in GitHub repository usememos/memos prior to 0.9.1.CVE-2022-48054.3Incorrect Use of Privileged APIs in GitHub repository usememos/memos prior to 0.9.1.CVE-2022-48065.3Authorization Bypass Through User-Controlled Key in GitHub repository usememos/memos prior to 0.9.1.CVE-2022-480635.5GNU Binutils before 2.40 was discovered to contain an excessive memory consumption vulnerability via the function load_separate_debug_files CVE-2022-480645.5GNU Binutils before 2.40 was discovered to contain an excessive memory consumption vulnerability via the function bfd_dwarf2_find_nearest_liCVE-2022-480655.5GNU Binutils before 2.40 was discovered to contain a memory leak vulnerability var the function find_abstract_instance in dwarf2.c.CVE-2022-480669.8An issue in the component global.so of Totolink A830R V4.1.2cu.5182 allows attackers to bypass authentication via a crafted cookie.CVE-2022-480675.5An information disclosure vulnerability in Totolink A830R V4.1.2cu.5182 allows attackers to obtain the root password via a brute-force attacCVE-2022-480697.5Totolink A830R V4.1.2cu.5182 was discovered to contain a command injection vulnerability via the QUERY_STRING parameter.CVE-2022-48074.3Improper Access Control in GitHub repository usememos/memos prior to 0.9.1.CVE-2022-480707.8Phicomm K2 v22.6.534.263 was discovered to contain a command injection vulnerability via the autoUpTime parameter in the automatic upgrade f