OTRS prior 2.4.0 credentials management

Summaryinfo

A vulnerability was found in OTRS. It has been rated as critical. Impacted is an unknown function. This manipulation causes credentials management. This vulnerability is registered as CVE-2010-4764. No exploit is available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability has been found in OTRS (Service Management Software) and classified as critical. Affected by this vulnerability is an unknown function. The manipulation with an unknown input leads to a credentials management vulnerability. The CWE definition for the vulnerability is CWE-255. As an impact it is known to affect integrity. The summary by CVE is:

Open Ticket Request System (OTRS) before 2.4.10, and 3.x before 3.0.3, does not present warnings about incoming encrypted e-mail messages that were based on revoked PGP or GPG keys, which makes it easier for remote attackers to spoof e-mail communication by leveraging a key that has a revocation signature.

The weakness was published 03/18/2011 (Website). It is possible to read the advisory at source.otrs.org. This vulnerability is known as CVE-2010-4764. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1552 according to MITRE ATT&CK.

Upgrading to version 2.4.0 eliminates this vulnerability.

The vulnerability is also documented in the databases at X-Force (66337) and Vulnerability Center (SBV-30789†). Similar entries are available at VDB-56879, VDB-56878, VDB-56877 and VDB-56874. Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Service Management Software

Name

• OTRS

Version

• 0.5
• 0.9
• 0.9.1
• 0.9.2
• 0.9.3
• 0.9.4
• 0.9.5
• 0.9.6
• 1.0.0
• 1.0.1
• 1.0.2
• 1.1.0
• 1.1.1
• 1.1.2
• 1.1.3
• 1.1.4
• 1.2.0
• 1.2.1
• 1.2.2
• 1.2.3
• 1.2.4
• 1.3.0
• 1.3.1
• 1.3.2
• 1.3.3
• 2.0.0
• 2.0.1
• 2.0.2
• 2.0.3
• 2.0.4
• 2.0.5
• 2.1.0
• 2.1.1
• 2.1.2
• 2.1.3
• 2.1.4
• 2.1.5
• 2.1.6
• 2.1.7
• 2.1.8
• 2.1.9
• 2.2.0
• 2.2.1
• 2.2.2
• 2.2.3
• 2.2.4
• 2.2.5
• 2.2.6
• 2.2.7
• 2.2.8
• 2.2.9
• 2.3.1
• 2.3.2
• 2.3.3
• 2.3.4
• 2.3.5

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion