PT-2011-1270 · Otrs · Open Ticket Request System

Publicado 2011-03-18 · Atualizado 2011-03-22 · CVE-2008-7277

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Média

Vetor base

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Open Ticket Request System (OTRS) versions prior to 2.3.0-beta4

Description The issue allows remote authenticated users to potentially bypass intended access restrictions. This occurs because the system checks for the wrong permission during authorization of merge operations, specifically checking for the rw permission instead of the configured merge permission.

Recommendations For versions prior to 2.3.0-beta4, update to version 2.3.0-beta4 or later to resolve the issue.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2008-7277

Produtos afetados

Open Ticket Request System

Referências · 7

• http://bugs.otrs.org/show_bug.cgi?id=3045 · Correção
• https://osv.dev/vulnerability/DEBIAN-CVE-2008-7277 · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-7277 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-7277 · Nota de Segurança
• https://security-tracker.debian.org/tracker/CVE-2008-7277 · Aviso do Fabricante
• http://source.otrs.org/viewvc.cgi/otrs/CHANGES?revision=1.1807 · Nota
• https://osv.dev/vulnerability/CVE-2008-7277 · Aviso do Fabricante