CVE-2021-36097CWE-266

Agents are able to lock the ticket without the "Owner" permission

Low · published October 18, 2021

CVSS v3.1
3.5
EPSS
1%
Percentile
43.5
In the wild
Unconfirmed
What it is

Agents are able to lock the ticket without the "Owner" permission. Once the ticket is locked, it could be moved to the queue where the agent has "rw" permissions and gain a full control. This issue affects: OTRS AG OTRS 8.0.x version: 8.0.16 and prior versions.

The record
Technical detail
CVSS v3.1
3.5 · LOW
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00523 · 43.5th percentile
Weakness
CWE-266 · Incorrect Privilege Assignment
Published
2021-10-18T07:00Z
EPSS history
Timeline
  • 18 OCT 07:00Z
    Agents are able to lock the ticket without the "Owner" permission
    cvelistv5