PT-2011-1710 · Otrs · Open Ticket Request System

Published 2011-03-18 · Updated 2011-03-22 · CVE-2010-4761

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Open Ticket Request System (OTRS) versions prior to 3.0.0-beta3

Description The issue concerns the customer-interface ticket-print dialog, which fails to properly restrict customer-visible data. This allows remote authenticated users to obtain potentially sensitive information from various fields, including the responsible, owner, accounted time, pending until, and lock fields, by reading the dialog.

Recommendations For versions prior to 3.0.0-beta3, update to version 3.0.0-beta3 or later to resolve the issue.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2010-4761

Affected Products

Open Ticket Request System

References · 7

• http://bugs.otrs.org/show_bug.cgi?id=5875 · Patch
• https://security-tracker.debian.org/tracker/CVE-2010-4761 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2010-4761 · Security Note
• https://osv.dev/vulnerability/CVE-2010-4761 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2010-4761 · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4761 · Note
• http://source.otrs.org/viewvc.cgi/otrs/CHANGES?revision=1.1807 · Note