Description
The SOAP interface in OTRS 2.1.x before 2.1.8 and 2.2.x before 2.2.6 allows remote attackers to "read and modify objects" via SOAP requests, related to "Missing security checks."
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 11 | otrs2 | 2.2.5-2 | — |
References
- 29622 third-party-advisory
- 29859 third-party-advisory
- SUSE-SR:2008:008 vendor-advisory
- http://otrs.org/advisory/OSA-2008-01-en/
- 28647 vdb-entry
- 29585 third-party-advisory
- FEDORA-2008-3100 vendor-advisory
- otrs-soapinterface-weak-security(41577) vdb-entry