CVE-2024-23794CWE-266

Agents are able to lock the ticket without the "Owner" permission

Medium · published July 15, 2024

CVSS v3.1
5.2
EPSS
0%
Percentile
18.1
In the wild
Unconfirmed
What it is

An incorrect privilege assignment vulnerability in the inline editing functionality of OTRS can lead to privilege escalation. This flaw allows an agent with read-only permissions to gain full access to a ticket. This issue arises in very rare instances when an admin has previously enabled the setting 'RequiredLock' of 'AgentFrontend::Ticket::InlineEditing::Property###Watch' in the system configuration.This issue affects OTRS:

* 8.0.X

* 2023.X

* from 2024.X through 2024.4.x

The record
Technical detail
CVSS v3.1
5.2 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00270 · 18.1th percentile
Weakness
CWE-266 · Incorrect Privilege Assignment
Published
2024-07-15T07:14Z
EPSS history
Timeline
  • 15 JUL 07:14Z
    Agents are able to lock the ticket without the "Owner" permission
    cvelistv5