CVE-2008-7277

2022-10-0316:13:53

mitre

www.cve.org

open ticket request system

authorization

vulnerability

merge operations

6.3 Medium

AI Score

Confidence

Low

0.002 Low

EPSS

Percentile

59.4%

JSON

Open Ticket Request System (OTRS) before 2.3.0-beta4 checks for the rw permission, instead of the configured merge permission, during authorization of merge operations, which might allow remote authenticated users to bypass intended access restrictions by merging two tickets.