CVE-2019-13457

An issue was discovered in Open Ticket Request System (OTRS) 7.0.x through 7.0.8

Medium · published March 10, 2020

CVSS v3.0
4.3
EPSS
1%
Percentile
59.6
In the wild
Unconfirmed
What it is

An issue was discovered in Open Ticket Request System (OTRS) 7.0.x through 7.0.8. A customer user can use the search results to disclose information from their "company" tickets (with the same CustomerID), even when the CustomerDisableCompanyTicketAccess setting is turned on.

The record
Technical detail
CVSS v3.0
4.3 · MEDIUM
Vector
CVSS:3.0/AC:L/AV:N/A:N/C:L/I:N/PR:L/S:U/UI:N
CVSS v4.0
Not supplied
EPSS
0.00907 · 59.6th percentile
Published
2020-03-10T17:16Z
EPSS history
Timeline
  • 10 MAR 17:16Z
    An issue was discovered in Open Ticket Request System (OTRS) 7.0.x through 7.0.8
    cvelistv5