Input validation error in OTRS

1) Input validation error

EUVDB-ID: #VU44770

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2011-2746

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote #AU# to gain access to sensitive information.

Unspecified vulnerability in Kernel/Modules/AdminPackageManager.pm in OTRS-Core in Open Ticket Request System (OTRS) 2.x before 2.4.11 and 3.x before 3.0.10 allows remote authenticated administrators to read arbitrary files via unknown vectors.

Mitigation

Install update from vendor's website.

Vulnerable software versions

OTRS: 2.0.0 - 3.0.9

CPE2.3

• cpe:2.3:a:otrs_org:open_ticket_request_system:2.0.0:*:*:*:*:*:*:*
• cpe:2.3:a:otrs_org:open_ticket_request_system:2.0.1:*:*:*:*:*:*:*
• cpe:2.3:a:otrs_org:open_ticket_request_system:2.0.2:*:*:*:*:*:*:*

External links

https://lists.opensuse.org/opensuse-updates/2011-09/msg00011.html
https://otrs.org/advisory/OSA-2011-03-en/
https://secunia.com/advisories/45701
https://secunia.com/advisories/45894
https://www.osvdb.org/74602
https://www.securityfocus.com/bid/49251

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.