PT-2014-8935 · Otrs · Otrs Help Desk

Published 2014-12-19 · Updated 2024-06-15 · CVE-2014-9324

Positive Technologies (AI Summary)

CVSS v2.0

6.0

Medium

Base vector

AV:N/AC:M/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions OTRS Help Desk versions 3.2.x through 3.2.16 OTRS Help Desk versions 3.3.x through 3.3.10 OTRS Help Desk versions 4.0.x through 4.0.2

Description The issue allows remote authenticated users to access and modify arbitrary tickets.

Recommendations For OTRS Help Desk versions 3.2.x through 3.2.16, update to version 3.2.17 or later. For OTRS Help Desk versions 3.3.x through 3.3.10, update to version 3.3.11 or later. For OTRS Help Desk versions 4.0.x through 4.0.2, update to version 4.0.3 or later.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2014-9324

DSA-3124-1

MGASA-2015-0031

OPENSUSE-SU-2024:10073-1

Affected Products

Otrs Help Desk

References · 36

• https://debian.org/security/2015/dsa-3124 · Vendor Advisory
• https://otrs.com/security-advisory-2014-06-incomplete-access-control · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2015-0031 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-3124-1 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2015:043 · Vendor Advisory
• https://security-tracker.debian.org/tracker/DSA-3124-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2014-9324 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-9324 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2014-9324 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10073-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2014-9324 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9324 · Security Note
• https://security-tracker.debian.org/tracker/source-package/otrs2 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2015-0031.html · Security Note
• https://suse.com/security/cve/CVE-2014-9324 · Note