CVE-2023-2534CWE-285

Information disclouse and DoS via websocket push events

High · published May 8, 2023

CVSS v3.1
7.6
EPSS
1%
Percentile
43.7
In the wild
Unconfirmed
What it is

Improper Authorization vulnerability in OTRS AG OTRS 8 (Websocket API backend) allows any as Agent authenticated attacker to track user behaviour and to gain live insight into overall system usage. User IDs can easily be correlated with real names e. g. via

ticket histories by any user. (Fuzzing for garnering other adjacent user/sensitive data). Subscribing to all possible push events could also lead to performance implications on the server side, depending on the size of the installation

and the number of active users. (Flooding)This issue affects OTRS: from 8.0.X before 8.0.32.

The record
Technical detail
CVSS v3.1
7.6 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L
CVSS v4.0
Not supplied
EPSS
0.00526 · 43.7th percentile
Weakness
CWE-285 · Improper Authorization
Published
2023-05-08T07:29Z
EPSS history
Timeline
  • 08 MAY 07:29Z
    Information disclouse and DoS via websocket push events
    cvelistv5