CVE-2024-23794: Agents are able to lock the ticket without the "Owner" permission
An incorrect privilege assignment vulnerability in the inline editing functionality of OTRS can lead to privilege escalation. This flaw allows an agent with read-only permissions to gain full access to a ticket. This issue arises in very rare instances when an admin has previously enabled the setting 'RequiredLock' of 'AgentFrontend::Ticket::InlineEditing::Property###Watch' in the system configuration.This issue affects OTRS:
8.0.X 2023.X from 2024.X through 2024.4.x
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2024-23794?
CVE-2024-23794 is classified as a high severity vulnerability due to its potential for privilege escalation.
How do I fix CVE-2024-23794?
To fix CVE-2024-23794, update OTRS to a version greater than 2024.5.2 or apply any available security patches.
What impact does CVE-2024-23794 have on OTRS users?
CVE-2024-23794 can allow agents with read-only permissions to gain full access to tickets, compromising security.
What versions of OTRS are affected by CVE-2024-23794?
CVE-2024-23794 affects OTRS versions from 8.0.0 up to 2024.5.2.
Who is primarily affected by CVE-2024-23794?
OTRS administrator and agent users are primarily affected by CVE-2024-23794 due to the privilege escalation capability.