PT-2011-1712 · Otrs · Open Ticket Request System

Published 2011-03-18 · Updated 2011-03-22 · CVE-2010-4763

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Open Ticket Request System (OTRS) versions prior to 3.0.0-beta1

Description The issue concerns the ACL-customer-status Ticket Type setting, which fails to restrict ticket options after an AJAX reload. This allows remote authenticated users to bypass intended restrictions on Status, Service, and Queue selections.

Recommendations For versions prior to 3.0.0-beta1, update to version 3.0.0-beta1 or later to resolve the issue.

Exploit

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2010-4763

Affected Products

Open Ticket Request System

References · 7

• 🔥 http://bugs.otrs.org/show_bug.cgi?id=4399 · Exploit
• https://osv.dev/vulnerability/DEBIAN-CVE-2010-4763 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2010-4763 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2010-4763 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2010-4763 · Security Note
• http://source.otrs.org/viewvc.cgi/otrs/CHANGES?revision=1.1807 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4763 · Note