CVE-2024-43446: Improper check of permissions in Generic Interface

Published Jan 27, 2025

Updated

An improper privilege management vulnerability in OTRS Generic Interface module allows change of the Ticket status even if the user only has ro permissions.

This issue affects:

OTRS 7.0.X

OTRS 8.0.X OTRS 2023.X OTRS 2024.X

((OTRS)) Community Edition: 6.0.x

Products based on the ((OTRS)) Community Edition also very likely to be affected

Affected Software

1 affected component

OTRS OTRS>=7.0.0<8.0.0, >=8.0.0<2023.0, >=2023.0<2024.0, >=6.0.x

Remediation

Information

Update to OTRS 2025.1.x. Please note that there will be no OTRS 7 patches

Event History

Jan 27, 2025

CVE Published

via MITRE·05:58 AM

Data Sourced

via MITRE·05:58 AM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·06:15 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2024-43446?

CVE-2024-43446 is a medium severity vulnerability that allows privilege escalation affecting ticket status management in OTRS.

How do I fix CVE-2024-43446?

To fix CVE-2024-43446, upgrade to OTRS versions 8.0.X or above, or apply the security patches issued by OTRS.

What versions of OTRS are affected by CVE-2024-43446?

CVE-2024-43446 affects OTRS versions 6.0.X, 7.0.X, 8.0.X, 2023.X, and 2024.X.

What kind of vulnerability is CVE-2024-43446?

CVE-2024-43446 is categorized as an improper privilege management vulnerability.

What are the potential impacts of CVE-2024-43446?

The potential impact of CVE-2024-43446 includes unauthorized changes to ticket statuses by users with read-only permissions.