Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2013-3551

Kernel/Modules/AgentTicketPhone.pm in Open Ticket Request System (OTRS) 3.0.x before 3.0.20, 3.1.x before 3.1.16, and 3.2.x before 3.2.7, and OTRS ITSM 3.0.x before 3.0.8, 3.1.x before 3.1.9, and 3.2.x before 3.2.5 does not properly restrict tickets, which allows remote attackers with a valid agent login to read restricted tickets via a crafted URL involving the ticket split mechanism.

Published

2020-02-21T16:15:11.327

Last Modified

2024-11-21T01:53:51.913

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 6.5 (MEDIUM)

CVSSv2 Vector

AV:N/AC:L/Au:S/C:P/I:N/A:N

  • Access Vector: NETWORK
  • Access Complexity: LOW
  • Authentication: SINGLE
  • Confidentiality Impact: PARTIAL
  • Integrity Impact: NONE
  • Availability Impact: NONE
Exploitability Score

8.0

Impact Score

2.9

Weaknesses
  • Type: Primary
    CWE-200
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application otrs otrs < 3.0.20 Yes
Application otrs otrs < 3.1.16 Yes
Application otrs otrs < 3.2.7 Yes
Application otrs otrs_itsm < 3.0.8 Yes
Application otrs otrs_itsm < 3.1.9 Yes
Application otrs otrs_itsm < 3.2.5 Yes
References