Zammad 6.4.2

Zammad Team
Wed, 02 Apr 2025 10:00:00 +0200

This release includes important security patches. Please read the release notes carefully and update your Zammad system as soon as possible.

Server Side Request Forgery

Authenticated administrators can configure webhooks that send POST requests when specific conditions are met. If a webhook endpoint responds with a redirect, Zammad would automatically follow up with a GET request. This behavior could be exploited by attackers to initiate GET requests to internal network resources. This vulnerability has now been addressed.

📖 For more details, please refer to the Security Advisory ZAA-2025-01.

Incorrect Access Control

When changing their two-factor authentication configuration, users must re-authenticate using their current password. Previously, this was enforced only on the frontend and not validated via the API. This security gap has since been closed.

📖 For more details, please refer to the Security Advisory ZAA-2025-02.

Incorrect Access Control to Article Drafts

Shared article drafts are meant to be visible only to agents. However, logged-in customers were able to see and manipulate draft information for their tickets via the browser console and API. This unintended access has been blocked.

📖 For more details, please refer to the Security Advisory ZAA-2025-03.

Incorrect Access Control

An agent with general knowledge base permissions was previously able to fetch content via the API that they were not explicitly authorized to access. The underlying permission checks have now been corrected to enforce proper restrictions.

📖 For more details, please refer to the Security Advisory ZAA-2025-04.

Technical Requirements

Please note that you must meet the following browser requirements to use this version:

Chrome: 83

Firefox: 78

Explorer: 11

Safari: 11

Opera: 69

Edge: 83

Advisories

ZAA-2025-01
ZAA-2025-02
ZAA-2025-03
ZAA-2025-04

Download Zammad 6.4.2

All improvements can be found in the Changelog.

Packages

Ubuntu / Debian

OpenSUSE / SLES

CentOS / RHEL

Docker-Compose

Source code

ftp.zammad.com/zammad-6.4.2.tar.bz2 (f5d9965a036010d151e0229561d79a6a)

ftp.zammad.com/zammad-6.4.2.tar.gz (333067a44ec600e18bfef8bbce2cc0ed)

ftp.zammad.com/zammad-6.4.2.zip (0fecdd8f4d14b3a0c2d10d1089339bb9)

Upgrade

Here you can find information on upgrading your Zammad installation:

With Package

From source

With Docker