CVE-2013-3551: Infoleak
First published: Fri Feb 21 2020(Updated: )
Kernel/Modules/AgentTicketPhone.pm in Open Ticket Request System (OTRS) 3.0.x before 3.0.20, 3.1.x before 3.1.16, and 3.2.x before 3.2.7, and OTRS ITSM 3.0.x before 3.0.8, 3.1.x before 3.1.9, and 3.2.x before 3.2.5 does not properly restrict tickets, which allows remote attackers with a valid agent login to read restricted tickets via a crafted URL involving the ticket split mechanism.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Otrs Otrs | >=3.0.0<3.0.20 | |
| Otrs Otrs | >=3.1.0<3.1.16 | |
| Otrs Otrs | >=3.2.0<3.2.7 | |
| Otrs Otrs Itsm | >=3.0.0<3.0.8 | |
| Otrs Otrs Itsm | >=3.1.0<3.1.9 | |
| Otrs Otrs Itsm | >=3.2.0<3.2.5 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2013-3551.
What is the severity of CVE-2013-3551?
The severity of CVE-2013-3551 is medium.
Which software versions are affected by CVE-2013-3551?
The affected software versions for CVE-2013-3551 are OTRS 3.0.x (3.0.0 to 3.0.20), 3.1.x (3.1.0 to 3.1.16), 3.2.x (3.2.0 to 3.2.7), and OTRS ITSM 3.0.x (3.0.0 to 3.0.8), 3.1.x (3.1.0 to 3.1.9), and 3.2.x (3.2.0 to 3.2.5).
How can remote attackers exploit CVE-2013-3551?
Remote attackers with a valid agent account can exploit CVE-2013-3551 by improperly accessing and manipulating tickets.
Are there any references/documentation available for CVE-2013-3551?
Yes, you can find references/documentation for CVE-2013-3551 at the following links: [1](http://advisories.mageia.org/MGASA-2013-0196.html), [2](https://bugs.gentoo.org/show_bug.cgi?id=CVE-2013-3551)
- collector/nvd-index
- agent/weakness
- agent/references
- agent/author
- agent/severity
- agent/type
- agent/description
- agent/event
- agent/first-publish-date
- agent/last-modified-date
- agent/softwarecombine
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/otrs
- canonical/otrs otrs
- version/otrs otrs/3.0.0
- version/otrs otrs/3.1.0
- version/otrs otrs/3.2.0
- canonical/otrs otrs itsm
- version/otrs otrs itsm/3.0.0
- version/otrs otrs itsm/3.1.0
- version/otrs otrs itsm/3.2.0