Summary
Ein entfernter authentifizierter Angreifer kann mehrere Schwachstellen in OTRS ausnutzen, um Sicherheitsmechanismen zu umgehen und um vertrauliche Informationen offenzulegen.
Product
Das Open Ticket Request System (OTRS) ist ein Ticketsystem für Help-Desks.
Vulnerabilities 2
-
Medium 5.7
Information exlosure in external interface
Improper filtering of fields when using the export function in the ticket overview of the external interface in OTRS could allow an authorized user to download a list of tickets containing information about tickets of other customers. The problem only occurs …
-
Medium 5.2
Agents are able to lock the ticket without the "Owner" permission
An incorrect privilege assignment vulnerability in the inline editing functionality of OTRS can lead to privilege escalation. This flaw allows an agent with read-only permissions to gain full access to a ticket. This issue arises in very rare instances when a…
Revision history
-
#1
Initiale Fassung
References
-
OTRS Security Advisory 2024-06 vom 2024-07-14
https://otrs.com/release-notes/otrs-security-advisory-2024-06/
-
OTRS Security Advisory 2024-07 vom 2024-07-14
https://otrs.com/release-notes/otrs-security-advisory-2024-07/