CVE-2019-12746: Infoleak
An issue was discovered in Open Ticket Request System (OTRS) Community Edition 5.0.x through 5.0.36 and 6.0.x through 6.0.19. A user logged into OTRS as an agent might unknowingly disclose their session ID by sharing the link of an embedded ticket article with third parties. This identifier can be then be potentially abused in order to impersonate the agent user.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2019-12746?
CVE-2019-12746 is classified as a medium severity vulnerability.
How do I fix CVE-2019-12746?
To fix CVE-2019-12746, upgrade to OTRS Community Edition version 5.0.37 or 6.0.20 or later.
Who is affected by CVE-2019-12746?
CVE-2019-12746 affects OTRS Community Edition versions 5.0.x through 5.0.36 and 6.0.x through 6.0.19.
What does CVE-2019-12746 exploit?
CVE-2019-12746 exploits a vulnerability where a session ID can be disclosed by sharing links of embedded ticket articles.
What systems are impacted by CVE-2019-12746?
CVE-2019-12746 impacts systems running affected versions of OTRS Community Edition and potentially Debian Linux 8.0.