| CVSS Meta Temp Score | Current Exploit Price (≈) | CTI Interest Score |
|---|---|---|
| 4.1 | $0-$5k | 0.00 |
Summary
A vulnerability was found in OTRS and classified as problematic. This affects an unknown part. Executing a manipulation can lead to access control. This vulnerability is tracked as CVE-2010-4761. No exploit exists. It is suggested to upgrade the affected component.
Details
A vulnerability classified as problematic was found in OTRS (Service Management Software). This vulnerability affects an unknown code. The manipulation with an unknown input leads to a access control vulnerability. The CWE definition for the vulnerability is CWE-264. As an impact it is known to affect confidentiality. CVE summarizes:
The customer-interface ticket-print dialog in Open Ticket Request System (OTRS) before 3.0.0-beta3 does not properly restrict customer-visible data, which allows remote authenticated users to obtain potentially sensitive information from the (1) responsible, (2) owner, (3) accounted time, (4) pending until, and (5) lock fields by reading this dialog.
The weakness was disclosed 03/18/2011 (Website). The advisory is shared for download at bugs.otrs.org. This vulnerability was named CVE-2010-4761. The exploitation appears to be easy. The attack can be initiated remotely. A single authentication is needed for exploitation. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1068.
Upgrading to version 2.4.0 eliminates this vulnerability.
The vulnerability is also documented in the databases at X-Force (66340) and Vulnerability Center (SBV-30795†). The entries VDB-56876, VDB-56875, VDB-56874 and VDB-56873 are pretty similar. VulDB is the best source for vulnerability data and more expert information about this specific topic.
Product
Type
Name
License
CPE 2.3
CPE 2.2
CVSSv4
VulDB Vector: 🔍VulDB Reliability: 🔍
CVSSv3
VulDB Meta Base Score: 4.3VulDB Meta Temp Score: 4.1
VulDB Base Score: 4.3
VulDB Temp Score: 4.1
VulDB Vector: 🔍
VulDB Reliability: 🔍
CVSSv2
| AV | AC | Au | C | I | A |
|---|---|---|---|---|---|
| 💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
| 💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
| 💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
| Vector | Complexity | Authentication | Confidentiality | Integrity | Availability |
|---|---|---|---|---|---|
| Unlock | Unlock | Unlock | Unlock | Unlock | Unlock |
| Unlock | Unlock | Unlock | Unlock | Unlock | Unlock |
| Unlock | Unlock | Unlock | Unlock | Unlock | Unlock |
VulDB Base Score: 🔍
VulDB Temp Score: 🔍
VulDB Reliability: 🔍
NVD Base Score: 🔍
Exploiting
Class: Access controlCWE: CWE-264
CAPEC: 🔍
ATT&CK: 🔍
Physical: No
Local: No
Remote: Yes
Availability: 🔍
Status: Not defined
EPSS Score: 🔍
EPSS Percentile: 🔍
Price Prediction: 🔍
Current Price Estimation: 🔍
| 0-Day | Unlock | Unlock | Unlock | Unlock |
|---|---|---|---|---|
| Today | Unlock | Unlock | Unlock | Unlock |
Threat Intelligence
Interest: 🔍Active Actors: 🔍
Active APT Groups: 🔍
Countermeasures
Recommended: UpgradeStatus: 🔍
0-Day Time: 🔍
Upgrade: OTRS 2.4.0
Timeline
03/16/2011 🔍03/18/2011 🔍
03/18/2011 🔍
03/18/2011 🔍
04/04/2011 🔍
03/20/2015 🔍
10/19/2021 🔍
Sources
Advisory: bugs.otrs.orgStatus: Not defined
Confirmation: 🔍
CVE: CVE-2010-4761 (🔍)
GCVE (CVE): GCVE-0-2010-4761
GCVE (VulDB): GCVE-100-56872
X-Force: 66340
Vulnerability Center: 30795 - Open Ticket Request System before 3.0.0-beta3 Remote Information Disclosure Vulnerability, Medium
See also: 🔍
Entry
Created: 03/20/2015 16:16Updated: 10/19/2021 20:49
Changes: 03/20/2015 16:16 (47), 03/20/2017 09:28 (6), 10/19/2021 20:49 (4)
Complete: 🔍
Cache ID: 216:BBD:103
VulDB is the best source for vulnerability data and more expert information about this specific topic.
No comments yet. Languages: en.
Please log in to comment.