OTRS up to 2.2.5 Access Restriction access control

Summaryinfo

A vulnerability marked as critical has been reported in OTRS. The affected element is an unknown function of the component Access Restriction. Performing a manipulation results in access control. This vulnerability is known as CVE-2008-7283. No exploit is available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, was found in OTRS (Service Management Software). This affects an unknown code of the component Access Restriction. The manipulation with an unknown input leads to a access control vulnerability. CWE is classifying the issue as CWE-264. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

Open Ticket Request System (OTRS) before 2.2.6, when customer group support is enabled, allows remote authenticated users to bypass intended access restrictions and perform web-interface updates to tickets by leveraging queue read permissions.

The weakness was published 03/18/2011 (Website). The advisory is shared at source.otrs.org. This vulnerability is uniquely identified as CVE-2008-7283. It is possible to initiate the attack remotely. A authentication is needed for exploitation. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1068 for this issue.

Upgrading to version 0.5 eliminates this vulnerability.

The vulnerability is also documented in the databases at X-Force (66478) and Vulnerability Center (SBV-30787†). Similar entries are available at VDB-56879, VDB-56878, VDB-56877 and VDB-56875. Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Service Management Software

Name

• OTRS

Version

• 0.5
• 1.0.0
• 1.0.1
• 1.0.2
• 1.1.0
• 1.1.1
• 1.1.2
• 1.1.3
• 1.1.4
• 1.2.0
• 1.2.1
• 1.2.2
• 1.2.3
• 1.2.4
• 1.3.0
• 1.3.1
• 1.3.2
• 1.3.3
• 2.0.0
• 2.0.1
• 2.0.2
• 2.0.3
• 2.0.4
• 2.0.5
• 2.1.0
• 2.1.1
• 2.1.2
• 2.1.3
• 2.1.4
• 2.1.5
• 2.1.6
• 2.1.7
• 2.1.8
• 2.1.9
• 2.2.0
• 2.2.1
• 2.2.2
• 2.2.3
• 2.2.4
• 2.2.5

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion