Vulnerabilities > CVE-2021-42084 - Infinite Loop vulnerability in Zammad

CVSS 6.5 - MEDIUM

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

LOW

Confidentiality impact

NONE

Integrity impact

NONE

Availability impact

HIGH

network

low complexity

zammad

CWE-835

NVD

Published: 2021-10-07

Updated: 2021-10-14

Summary

An issue was discovered in Zammad before 4.1.1. An attacker with valid agent credentials may send a series of crafted requests that cause an endless loop and thus cause denial of service.

Vulnerable Configurations

Part	Description	Count
Application	Zammad Zammad Zammad 1.0.0 Zammad Zammad 1.0.1 Zammad Zammad 1.0.2 Zammad Zammad 1.0.3 Zammad Zammad 1.0.4 Zammad Zammad 1.1.0 Zammad Zammad 1.1.1 Zammad Zammad 1.1.2 Zammad Zammad 1.1.3 Zammad Zammad 1.1.4 Zammad Zammad 1.2.0 Zammad Zammad 1.2.1 Zammad Zammad 1.2.2 Zammad Zammad 1.2.3 Zammad Zammad 1.3.0 Zammad Zammad 1.3.1 Zammad Zammad 1.3.2 Zammad Zammad 1.4.0 Zammad Zammad 1.4.1 Zammad Zammad 1.5.0 Zammad Zammad 1.5.1 Zammad Zammad 1.6.0 Zammad Zammad 1.6.1 Zammad Zammad 2.0.0 Zammad Zammad 2.0.1 Zammad Zammad 2.1.0 Zammad Zammad 2.1.1 Zammad Zammad 2.1.2 Zammad Zammad 2.2.0 Zammad Zammad 2.2.1 Zammad Zammad 2.2.2 Zammad Zammad 2.3.0 Zammad Zammad 2.3.1 Zammad Zammad 2.4.0 Zammad Zammad 2.4.1 Zammad Zammad 2.5.0 Zammad Zammad 2.5.1 Zammad Zammad 2.6.0 Zammad Zammad 2.6.1 Zammad Zammad 2.7.0 Zammad Zammad 2.7.1 Zammad Zammad 2.7.2 Zammad Zammad 2.8.0 Zammad Zammad 2.8.1 Zammad Zammad 2.9.0 Zammad Zammad 2.10.0 Zammad Zammad 3.0.0 Zammad Zammad 3.0.1 Zammad Zammad 3.1.0 Zammad Zammad 3.1.1 Zammad Zammad 3.2.0 Zammad Zammad 3.2.1 Zammad Zammad 3.3.0 Zammad Zammad 3.3.1 Zammad Zammad 3.4.0 Zammad Zammad 3.4.1 Zammad Zammad 3.5.0 Zammad Zammad 3.5.1 Zammad Zammad 3.6.0 Zammad Zammad 3.6.1 Zammad Zammad 4.0.0 Zammad Zammad 4.0.1 Zammad Zammad 4.1.0	63

Common Weakness Enumeration (CWE)

CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

References

https://zammad.com/en/advisories/zaa-2021-11