CVE-2019-18179

An issue was discovered in Open Ticket Request System (OTRS) 7.0.x through 7.0.12, and Community Edition 5.0.x through 5.0.38 and 6.0.x through 6.0.23

Low · published January 6, 2020

CVSS v3.0
3.5
EPSS
2%
Percentile
75.5
In the wild
Unconfirmed
What it is

An issue was discovered in Open Ticket Request System (OTRS) 7.0.x through 7.0.12, and Community Edition 5.0.x through 5.0.38 and 6.0.x through 6.0.23. An attacker who is logged into OTRS as an agent is able to list tickets assigned to other agents, even tickets in a queue where the attacker doesn't have permissions.

The record
Technical detail
CVSS v3.0
3.5 · LOW
Vector
CVSS:3.0/AC:L/AV:N/A:N/C:L/I:N/PR:L/S:U/UI:R
CVSS v4.0
Not supplied
EPSS
0.01594 · 75.5th percentile
Published
2020-01-06T00:00Z
EPSS history
Timeline
  • 06 JAN 00:00Z
    An issue was discovered in Open Ticket Request System (OTRS) 7.0.x through 7.0.12, and Community Edition 5.0.x through 5.0.38 and 6.0.x through 6.0.23
    cvelistv5