OTRS/OTRS ITSM Ticket AgentTicketPhone.pm information disclosure

Summaryinfo

A vulnerability labeled as problematic has been found in OTRS and OTRS ITSM. This vulnerability affects unknown code of the file Kernel/Modules/AgentTicketPhone.pm of the component Ticket Handler. The manipulation results in information disclosure. This vulnerability is identified as CVE-2013-3551. The attack can be executed remotely. There is not any exploit available. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in OTRS and OTRS ITSM (Service Management Software) (the affected version unknown). It has been classified as problematic. Affected is an unknown part of the file Kernel/Modules/AgentTicketPhone.pm of the component Ticket Handler. The manipulation with an unknown input leads to a information disclosure vulnerability. CWE is classifying the issue as CWE-200. The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. This is going to have an impact on confidentiality. CVE summarizes:

Kernel/Modules/AgentTicketPhone.pm in Open Ticket Request System (OTRS) 3.0.x before 3.0.20, 3.1.x before 3.1.16, and 3.2.x before 3.2.7, and OTRS ITSM 3.0.x before 3.0.8, 3.1.x before 3.1.9, and 3.2.x before 3.2.5 does not properly restrict tickets, which allows remote attackers with a valid agent login to read restricted tickets via a crafted URL involving the ticket split mechanism.

The weakness was released 04/21/2023 as GASA-2013-0196. The advisory is shared for download at advisories.mageia.org. This vulnerability is traded as CVE-2013-3551 since 05/16/2013. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1592.

The vulnerability scanner Nessus provides a plugin with the ID 67133 (Mandriva Linux Security Advisory : otrs (MDVSA-2013:188)), which helps to determine the existence of the flaw in a target environment. It is assigned to the family Mandriva Local Security Checks.

Upgrading eliminates this vulnerability.

The vulnerability is also documented in the databases at Tenable (67133) and SecurityFocus (BID 60117†). Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Service Management Software

Name

• OTRS
• OTRS ITSM

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion