Vulnerability Description
Open Ticket Request System (OTRS) before 2.4.0-beta2 does not properly enforce the move_into permission setting for a queue, which allows remote authenticated users to bypass intended access restrictions and read a ticket by watching this ticket, and then selecting the ticket from the watched-tickets list.
CVSS Score
LOW
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Otrs | Otrs | <= 2.4.0 |
Related Weaknesses (CWE)
References
- http://bugs.otrs.org/show_bug.cgi?id=3583Exploit
- http://source.otrs.org/viewvc.cgi/otrs/CHANGES?revision=1.1807
- http://bugs.otrs.org/show_bug.cgi?id=3583Exploit
- http://source.otrs.org/viewvc.cgi/otrs/CHANGES?revision=1.1807
FAQ
What is CVE-2009-5056?
CVE-2009-5056 is a vulnerability with a CVSS score of 2.1 (LOW). Open Ticket Request System (OTRS) before 2.4.0-beta2 does not properly enforce the move_into permission setting for a queue, which allows remote authenticated users to bypass intended access restricti...
How severe is CVE-2009-5056?
CVE-2009-5056 has been rated LOW with a CVSS base score of 2.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2009-5056?
Check the references section above for vendor advisories and patch information. Affected products include: Otrs Otrs.