CVE-2023-38058CWE-269

Tickets can be moved without permissions

Medium · published July 24, 2023

CVSS v3.1
4.1
EPSS
0%
Percentile
30.4
In the wild
Unconfirmed
What it is

An improper privilege check in the OTRS ticket move action in the agent interface allows any as agent authenticated attacker to to perform a move of an ticket without the needed permission.

This issue affects OTRS: from 8.0.X before 8.0.35.

The record
Technical detail
CVSS v3.1
4.1 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00376 · 30.4th percentile
Weakness
CWE-269 · Improper Privilege Management
Published
2023-07-24T08:28Z
EPSS history
Timeline
  • 24 JUL 08:28Z
    Tickets can be moved without permissions
    cvelistv5