CVE-2019-13457
MEDIUMOTRS 7.0.0-7.0.8 - Unauthorized Information Disclosure via Search Results
Title source: llmDescription
An issue was discovered in Open Ticket Request System (OTRS) 7.0.x through 7.0.8. A customer user can use the search results to disclose information from their "company" tickets (with the same CustomerID), even when the CustomerDisableCompanyTicketAccess setting is turned on.
References (5)
Core 5
Core References
Vendor Advisory x_refsource_misc
https://www.otrs.com/category/release-and-security-notes-en/
Vendor Advisory x_refsource_confirm
https://otrs.com/release-notes/otrs-security-advisory-2019-11/
Broken Link vendor-advisory
x_refsource_suse
http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00038.html
Broken Link vendor-advisory
x_refsource_suse
http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00066.html
Broken Link vendor-advisory
x_refsource_suse
http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00077.html
Scores
CVSS v3
4.3
EPSS
0.0091
EPSS Percentile
55.4%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Details
CWE
CWE-200
Status
published
Products (1)
otrs/otrs
7.0.0 - 7.0.8
Published
Mar 10, 2020
Tracked Since
Feb 18, 2026