Znuny vulnerabilities

In Znuny through 7.3.6, an attacker can bypass specific standard login procedures and gain unauthorized access to sensitive system functions by manipulating a specific HTTP request header. Because the application incorrectly trusts this header, an attacker can impersonate any user, including administrators, without requiring a password. The HTTPBasicAuth modules for the agent and customer interfaces read the username not only from $ENV{REMOTE_USER} but also, as a fallback, from $ENV{HTTP_REMOTE_USER}, which is populated directly from an attacker-controllable "Remote-User" request header.

Znuny through 7.3.6 constructs a ticket-search database query by directly concatenating user-supplied input into the SQL statement. Lack of validation of the ContentSearch parameter (expected to be "AND" or "OR") in Kernel::System::Ticket::TicketSearch and Kernel::System::Ticket::ArticleSearchIndex::DB allows injection of arbitrary SQL commands.

Znuny before LTS 6.5.22 allows AgentTicketEmailResend template XSS.

In Znuny LTS before 6.5.21 and Znuny before 7.3.3, there is reflected XSS in AdminCommunicationLog (communication log administration view).

Cross-Site Scripting (XSS) vulnerability in Znuny LTS before 6.5.21 and Znuny before 7.3.3 via stored user preferences.