#VU44770 Input validation error in OTRS - CVE-2011-2746

Vulnerability identifier: #VU44770

Vulnerability risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2011-2746

CWE-ID: CWE-20

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
OTRS
Web applications / Other software

Vendor: otrs.org

Description

The vulnerability allows a remote #AU# to gain access to sensitive information.

Unspecified vulnerability in Kernel/Modules/AdminPackageManager.pm in OTRS-Core in Open Ticket Request System (OTRS) 2.x before 2.4.11 and 3.x before 3.0.10 allows remote authenticated administrators to read arbitrary files via unknown vectors.

Mitigation
Install update from vendor's website.

Vulnerable software versions

OTRS: 2.0.0 - 3.0.9

---

External links
https://lists.opensuse.org/opensuse-updates/2011-09/msg00011.html
https://otrs.org/advisory/OSA-2011-03-en/
https://secunia.com/advisories/45701
https://secunia.com/advisories/45894
https://www.osvdb.org/74602
https://www.securityfocus.com/bid/49251

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.