CVE-2019-12746: Infoleak
First published: Wed Aug 21 2019(Updated: )
An issue was discovered in Open Ticket Request System (OTRS) Community Edition 5.0.x through 5.0.36 and 6.0.x through 6.0.19. A user logged into OTRS as an agent might unknowingly disclose their session ID by sharing the link of an embedded ticket article with third parties. This identifier can be then be potentially abused in order to impersonate the agent user.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| OTRS | >=5.0.0<=5.0.36 | |
| OTRS | >=6.0.0<=6.0.19 | |
| Debian GNU/Linux | =8.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00038.html
- http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00066.html
- http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00077.html
- https://community.otrs.com/security-advisory-2019-10-security-update-for-otrs-framework/
- https://lists.debian.org/debian-lts-announce/2019/08/msg00018.html
- https://lists.debian.org/debian-lts-announce/2023/08/msg00040.html
- https://www.otrs.com/category/release-and-security-notes-en/
Frequently Asked Questions
What is the severity of CVE-2019-12746?
CVE-2019-12746 is classified as a medium severity vulnerability.
How do I fix CVE-2019-12746?
To fix CVE-2019-12746, upgrade to OTRS Community Edition version 5.0.37 or 6.0.20 or later.
Who is affected by CVE-2019-12746?
CVE-2019-12746 affects OTRS Community Edition versions 5.0.x through 5.0.36 and 6.0.x through 6.0.19.
What does CVE-2019-12746 exploit?
CVE-2019-12746 exploits a vulnerability where a session ID can be disclosed by sharing links of embedded ticket articles.
What systems are impacted by CVE-2019-12746?
CVE-2019-12746 impacts systems running affected versions of OTRS Community Edition and potentially Debian Linux 8.0.
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/references
- agent/weakness
- agent/severity
- agent/remedy
- agent/description
- agent/first-publish-date
- agent/event
- agent/source
- agent/author
- collector/nvd-api
- agent/software-canonical-lookup-request
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- vendor/otrs
- canonical/otrs
- version/otrs/5.0.0
- version/otrs/5.0.36
- version/otrs/6.0.0
- version/otrs/6.0.19
- vendor/debian
- canonical/debian gnu/linux
- version/debian gnu/linux/8.0