CVE-2020-10102

An issue was discovered in Zammad 3.0 through 3.2. The Forgot Password functionality is implemented in a way that would enable an anonymous user to guess valid user emails. In the current implementation, the application responds differently depending on whether the input supplied was recognized as associated with a valid user. This behavior could be used as part of a two-stage automated attack. During the first stage, an attacker would iterate through a list of account names to determine which correspond to valid accounts. During the second stage, the attacker would use a list of common passwords to attempt to brute force credentials for accounts that were recognized by the system in the first stage.

• CWE-203

• https://zammad.com/news/security-advisory-zaa-2020-07Patch, Vendor Advisory
• https://zammad.com/news/security-advisory-zaa-2020-07Patch, Vendor Advisory

Published

Mar 5, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-10097An issue was discovered in Zammad 3.0 through 3.2. It may re…5.3
• CVE-2020-10098An XSS issue was discovered in Zammad 3.0 through 3.2. Malic…5.4
• CVE-2020-10099An XSS issue was discovered in Zammad 3.0 through 3.2. Malic…5.4
• CVE-2020-1010An elevation of privilege vulnerability exists in Windows Bl…7.8
• CVE-2020-10100An issue was discovered in Zammad 3.0 through 3.2. It allows…6.5
• CVE-2020-10101An issue was discovered in Zammad 3.0 through 3.2. The WebSo…7.5
• CVE-2020-10103An XSS issue was discovered in Zammad 3.0 through 3.2. Malic…5.4
• CVE-2020-10104An issue was discovered in Zammad 3.0 through 3.2. After aut…4.3
• CVE-2020-10105An issue was discovered in Zammad 3.0 through 3.2. It return…5.3
• CVE-2020-10106PHPGurukul Daily Expense Tracker System 1.0 is vulnerable to…9.8
• CVE-2020-10107PHPGurukul Daily Expense Tracker System 1.0 is vulnerable to…5.4
• CVE-2020-10108In Twisted Web through 19.10.0, there was an HTTP request sp…9.8