PT-2011-1712 · Otrs · Open Ticket Request System

Publicado 2011-03-18 · Atualizado 2011-03-22 · CVE-2010-4763

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Média

Vetor base

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Open Ticket Request System (OTRS) versions prior to 3.0.0-beta1

Description The issue concerns the ACL-customer-status Ticket Type setting, which fails to restrict ticket options after an AJAX reload. This allows remote authenticated users to bypass intended restrictions on Status, Service, and Queue selections.

Recommendations For versions prior to 3.0.0-beta1, update to version 3.0.0-beta1 or later to resolve the issue.

Exploit

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2010-4763

Produtos afetados

Open Ticket Request System

Referências · 7

• 🔥 http://bugs.otrs.org/show_bug.cgi?id=4399 · Exploit
• http://source.otrs.org/viewvc.cgi/otrs/CHANGES?revision=1.1807 · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2010-4763 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2010-4763 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2010-4763 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2010-4763 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4763 · Nota