PT-2023-26269 · Otrs · Otrs

Published 2023-07-24 · Updated 2023-08-01 · CVE-2023-38058

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions OTRS versions 8.0.X through 8.0.34

Description An improper privilege check in the OTRS ticket move action in the agent interface allows any authenticated attacker to perform a move of a ticket without the needed permission.

Recommendations For OTRS versions 8.0.X through 8.0.34, update to version 8.0.35 or later to resolve the issue. As a temporary workaround, consider restricting access to the ticket move action in the agent interface until a patch is available.

Fix

Incorrect Authorization

Improper Privilege Management

Weakness Enumeration

CWE-863

CWE-269

Related Identifiers

CVE-2023-38058

Affected Products

Otrs

References · 7

• https://cve.org/CVERecord?id=CVE-2023-38058 · Security Note
• https://ubuntu.com/security/CVE-2023-38058 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-38058 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-38058 · Vendor Advisory
• https://otrs.com/release-notes/otrs-security-advisory-2023-07 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-38058 · Security Note
• https://t.me/cvenotify/54997 · Telegram Post