CVE-2022-35488: Zammad

High severity, CVSS 7.5. EPSS: 0.9% chance of exploitation in the next 30 days.

In Zammad 5.2.0, an attacker could manipulate the rate limiting in the 'forgot password' feature of Zammad, and thereby send many requests for a known account to cause Denial Of Service by many generated emails which would also spam the victim.

Affected products

• Zammad Zammad: version 5.2.0 only

Published 2022-08-08. Last modified 2026-06-17.