CVE-2010-4768
published 2011-03-18CVE-2010-4768: Open Ticket Request System (OTRS) before 2.3.5 does not properly disable hidden permissions, which allows remote authenticated users to bypass intended queue…
PriorityP427medium6CVSS 2.0
AVNACMAuSCPIPAP
EPSS
0.97%
57.5th percentile
Open Ticket Request System (OTRS) before 2.3.5 does not properly disable hidden permissions, which allows remote authenticated users to bypass intended queue access restrictions in opportunistic circumstances by visiting a ticket, related to a certain ordering of permission-set and permission-remove operations involving both hidden permissions and other permissions.
Affected
52 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | otrs2 | < otrs2 2.4.5-1 (bullseye) | otrs2 2.4.5-1 (bullseye) |
| otrs | otrs | <= 2.3.4 | — |
| otrs | otrs | — | — |
| otrs | otrs | — | — |
| otrs | otrs | — | — |
| otrs | otrs | — | — |
| otrs | otrs | — | — |
| otrs | otrs | — | — |
| otrs | otrs | — | — |
| otrs | otrs | — | — |
| otrs | otrs | — | — |
| otrs | otrs | — | — |
| otrs | otrs | — | — |
| otrs | otrs | — | — |
| otrs | otrs | — | — |
| otrs | otrs | — | — |
| otrs | otrs | — | — |
| otrs | otrs | — | — |
| otrs | otrs | — | — |
| otrs | otrs | — | — |
| otrs | otrs | — | — |
| otrs | otrs | — | — |
| otrs | otrs | — | — |
| otrs | otrs | — | — |
| otrs | otrs | — | — |
CVSS provenance
nvdv2.06.0MEDIUMAV:N/AC:M/Au:S/C:P/I:P/A:P
osv6.0MEDIUM
vendor_debian6.0LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-gh7q-c68r-vp9c: Open Ticket Request System (OTRS) before 2
ghsa_unreviewed·2022-05-17
CVE-2010-4768 [MEDIUM] GHSA-gh7q-c68r-vp9c: Open Ticket Request System (OTRS) before 2
Open Ticket Request System (OTRS) before 2.3.5 does not properly disable hidden permissions, which allows remote authenticated users to bypass intended queue access restrictions in opportunistic circumstances by visiting a ticket, related to a certain ordering of permission-set and permission-remove operations involving both hidden permissions and other permissions.
OSV
CVE-2010-4768: Open Ticket Request System (OTRS) before 2
osv·2011-03-18·CVSS 6.0
CVE-2010-4768 [MEDIUM] CVE-2010-4768: Open Ticket Request System (OTRS) before 2
Open Ticket Request System (OTRS) before 2.3.5 does not properly disable hidden permissions, which allows remote authenticated users to bypass intended queue access restrictions in opportunistic circumstances by visiting a ticket, related to a certain ordering of permission-set and permission-remove operations involving both hidden permissions and other permissions.
Debian
CVE-2010-4768: otrs2 - Open Ticket Request System (OTRS) before 2.3.5 does not properly disable hidden ...
vendor_debian·2010·CVSS 6.0
CVE-2010-4768 [MEDIUM] CVE-2010-4768: otrs2 - Open Ticket Request System (OTRS) before 2.3.5 does not properly disable hidden ...
Open Ticket Request System (OTRS) before 2.3.5 does not properly disable hidden permissions, which allows remote authenticated users to bypass intended queue access restrictions in opportunistic circumstances by visiting a ticket, related to a certain ordering of permission-set and permission-remove operations involving both hidden permissions and other permissions.
Scope: local
bullseye: resolved (fixed in 2.4.5-1)
No detection rules found.
No public exploits indexed.
2011-03-18
Published