PT-2011-1270 · Otrs · Open Ticket Request System

Published 2011-03-18 · Updated 2011-03-22 · CVE-2008-7277

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Open Ticket Request System (OTRS) versions prior to 2.3.0-beta4

Description The issue allows remote authenticated users to potentially bypass intended access restrictions. This occurs because the system checks for the wrong permission during authorization of merge operations, specifically checking for the rw permission instead of the configured merge permission.

Recommendations For versions prior to 2.3.0-beta4, update to version 2.3.0-beta4 or later to resolve the issue.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2008-7277

Affected Products

Open Ticket Request System

References · 7

• http://bugs.otrs.org/show_bug.cgi?id=3045 · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2008-7277 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-7277 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2008-7277 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2008-7277 · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-7277 · Note
• http://source.otrs.org/viewvc.cgi/otrs/CHANGES?revision=1.1807 · Note