CVE-2013-3551

MEDIUM

OTRS 3.0.x < 3.0.20, 3.1.x < 3.1.16, 3.2.x < 3.2.7 & OTRS ITSM Sensitive Info Exposure via Ticket Split

Title source: llm

Description

Kernel/Modules/AgentTicketPhone.pm in Open Ticket Request System (OTRS) 3.0.x before 3.0.20, 3.1.x before 3.1.16, and 3.2.x before 3.2.7, and OTRS ITSM 3.0.x before 3.0.8, 3.1.x before 3.1.9, and 3.2.x before 3.2.5 does not properly restrict tickets, which allows remote attackers with a valid agent login to read restricted tickets via a crafted URL involving the ticket split mechanism.

References (2)

Core 2

Core References

Third Party Advisory x_refsource_misc

http://advisories.mageia.org/MGASA-2013-0196.html

Issue Tracking, Third Party Advisory x_refsource_misc

https://bugs.gentoo.org/show_bug.cgi?id=CVE-2013-3551

Scores

CVSS v3 6.5

EPSS 0.0158

EPSS Percentile 72.5%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Details

CWE

CWE-200

Status published

Products (2)

otrs/otrs 3.0.0 - 3.0.20

otrs/otrs_itsm 3.0.0 - 3.0.8

Published Feb 21, 2020

Tracked Since Feb 18, 2026