CVE-2020-10105

An issue was discovered in Zammad 3.0 through 3.2. It returns source code of static resources when submitting an OPTIONS request, rather than a GET request. Disclosure of source code allows for an attacker to formulate more precise attacks. Source code was disclosed for the file 404.html (/zammad/public/404.html)

• CWE-552

• https://zammad.com/news/security-advisory-zaa-2020-09Patch, Vendor Advisory
• https://zammad.com/news/security-advisory-zaa-2020-09Patch, Vendor Advisory

Published

Mar 5, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-1010An elevation of privilege vulnerability exists in Windows Bl…7.8
• CVE-2020-10100An issue was discovered in Zammad 3.0 through 3.2. It allows…6.5
• CVE-2020-10101An issue was discovered in Zammad 3.0 through 3.2. The WebSo…7.5
• CVE-2020-10102An issue was discovered in Zammad 3.0 through 3.2. The Forgo…5.3
• CVE-2020-10103An XSS issue was discovered in Zammad 3.0 through 3.2. Malic…5.4
• CVE-2020-10104An issue was discovered in Zammad 3.0 through 3.2. After aut…4.3
• CVE-2020-10106PHPGurukul Daily Expense Tracker System 1.0 is vulnerable to…9.8
• CVE-2020-10107PHPGurukul Daily Expense Tracker System 1.0 is vulnerable to…5.4
• CVE-2020-10108In Twisted Web through 19.10.0, there was an HTTP request sp…9.8
• CVE-2020-10109In Twisted Web through 19.10.0, there was an HTTP request sp…9.8
• CVE-2020-1011An elevation of privilege vulnerability exists when the Wind…7.8
• CVE-2020-10110Citrix Gateway 11.1, 12.0, and 12.1 allows Information Expos…5.3