PT-2020-9401 · Otrs+1 · Otrs+1

Tobias Kirchner · Published 2020-03-10 · Updated 2023-01-27 · CVE-2019-13457

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Open Ticket Request System (OTRS) versions 7.0.x through 7.0.8

Description: An issue was discovered in Open Ticket Request System (OTRS) where a customer user can use the search results to disclose information from their "company" tickets, even when the CustomerDisableCompanyTicketAccess setting is turned on. This allows access to tickets with the same CustomerID.

Recommendations: For versions 7.0.x through 7.0.8, consider disabling the search function for customer users until a patch is available, or adjust the CustomerDisableCompanyTicketAccess setting to restrict access to company tickets. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2019-13457

OPENSUSE-SU-2020:0551-1

OPENSUSE-SU-2020:1475-1

OPENSUSE-SU-2020:1509-1

OPENSUSE-SU-2020_0551-1

OPENSUSE-SU-2020_1475-1

Affected Products

Otrs

Suse

References · 49

• https://cve.org/CVERecord?id=CVE-2019-13457 · Security Note
• https://otrs.com/release-notes/otrs-security-advisory-2019-11 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00066.html · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-13457 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00038.html · Vendor Advisory
• https://otrs.com/category/release-and-security-notes-en · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2020:0551-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2020:1509-1 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00077.html · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2020:1475-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-13457 · Security Note
• https://ubuntu.com/security/CVE-2019-13457 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-13457 · Vendor Advisory
• https://suse.com/security/cve/CVE-2020-1772 · Note
• https://suse.com/security/cve/CVE-2019-12248 · Note