#VU51859 Information disclosure in OTRS - CVE-2019-13457
Published: March 10, 2020 / Updated: April 1, 2021
Vulnerability identifier: #VU51859
Vulnerability risk: Low
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2019-13457
CWE-ID: CWE-200
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerable software:
OTRS
OTRS
Software vendor:
otrs.org
otrs.org
Description
The vulnerability allows a remote authenticated user to gain access to sensitive information.
An issue was discovered in Open Ticket Request System (OTRS) 7.0.x through 7.0.8. A customer user can use the search results to disclose information from their "company" tickets (with the same CustomerID), even when the CustomerDisableCompanyTicketAccess setting is turned on.
Remediation
Install update from vendor's website.
External links
- http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00038.html
- http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00066.html
- http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00077.html
- https://otrs.com/release-notes/otrs-security-advisory-2019-11/
- https://www.otrs.com/category/release-and-security-notes-en/