Security Advisory Details

  • ID: ZAA-2021-14
  • Date: 10/05/2021
  • Title: Remote code execution due to insecure deserialisation
  • Severity: medium
  • Product: Zammad 1.0.x up to 4.1.0
  • Fixed in: Zammad 4.1.1, 5.0.0
  • References:
    --> CVE: CVE-2021-42090

Vulnerability Descriptions

Remote code execution due to insecure deserialisation

Zammad comes with a Form functionality that can be embedded in a website by including a script which allows website visitors to create a Ticket via a form. However, there is a vulnerability in the deserialisation of the form data that allows the execution of malicious code in the context of the application server.

Special 🙏 and 🤘 and ❤️ to:

This vulnerability is fixed in the latest versions of Zammad and it is recommended to upgrade to one of these.

Fixed releases can be found at:

Additional information

Online version of this advisory: https://zammad.com/en/advisories/zaa-2021-14

Send all remarks to security issues to security@zammad.com.