Updated otrs package fixes security vulnerabilities
2013-07-01T19:16:22
ID MGASA-2013-0196 Type mageia Reporter Gentoo Foundation Modified 2013-07-01T19:16:22
Description
An attacker with a valid agent login could manipulate URLs in the ticket watch mechanism to see contents of tickets they are not permitted to see (CVE-2013-3551, CVE-2013-4088).
{"nessus": [{"lastseen": "2021-08-19T12:53:37", "description": "Updated otrs package fixes security vulnerabilities :\n\nAn attacker with a valid agent login could manipulate URLs in the ticket watch mechanism to see contents of tickets they are not permitted to see (CVE-2013-3551, CVE-2013-4088).", "cvss3": {"score": null, "vector": null}, "published": "2013-07-03T00:00:00", "type": "nessus", "title": "Mandriva Linux Security Advisory : otrs (MDVSA-2013:188)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2013-3551", "CVE-2013-4088"], "modified": "2021-01-06T00:00:00", "cpe": ["p-cpe:/a:mandriva:linux:otrs", "cpe:/o:mandriva:business_server:1"], "id": "MANDRIVA_MDVSA-2013-188.NASL", "href": "https://www.tenable.com/plugins/nessus/67133", "sourceData": "#%NASL_MIN_LEVEL 70300\n\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Mandriva Linux Security Advisory MDVSA-2013:188. \n# The text itself is copyright (C) Mandriva S.A.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(67133);\n script_version(\"1.6\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/06\");\n\n script_cve_id(\"CVE-2013-3551\", \"CVE-2013-4088\");\n script_bugtraq_id(60117, 60688);\n script_xref(name:\"MDVSA\", value:\"2013:188\");\n\n script_name(english:\"Mandriva Linux Security Advisory : otrs (MDVSA-2013:188)\");\n script_summary(english:\"Checks rpm output for the updated package\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Mandriva Linux host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Updated otrs package fixes security vulnerabilities :\n\nAn attacker with a valid agent login could manipulate URLs in the\nticket watch mechanism to see contents of tickets they are not\npermitted to see (CVE-2013-3551, CVE-2013-4088).\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://advisories.mageia.org/MGASA-2013-0196.html\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected otrs package.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N\");\n script_set_cvss_temporal_vector(\"CVSS2#E:F/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:otrs\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:mandriva:business_server:1\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2013/07/02\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2013/07/03\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2013-2021 Tenable Network Security, Inc.\");\n script_family(english:\"Mandriva Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/Mandrake/release\", \"Host/Mandrake/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Mandrake/release\")) audit(AUDIT_OS_NOT, \"Mandriva / Mandake Linux\");\nif (!get_kb_item(\"Host/Mandrake/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (cpu !~ \"^(amd64|i[3-6]86|x86_64)$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Mandriva / Mandrake Linux\", cpu);\n\n\nflag = 0;\nif (rpm_check(release:\"MDK-MBS1\", reference:\"otrs-3.2.8-1.mbs1\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());\n else security_warning(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 5, "vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N"}}, {"lastseen": "2021-08-19T12:54:45", "description": "It was discovered that users with a valid agent login could use crafted URLs to bypass access control restrictions and read tickets to which they should not have access.\n\nThe oldstable distribution (squeeze) is not affected by this problem.", "cvss3": {"score": 6.5, "vector": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"}, "published": "2013-06-20T00:00:00", "type": "nessus", "title": "Debian DSA-2712-1 : otrs2 - privilege escalation", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2013-4088"], "modified": "2021-01-11T00:00:00", "cpe": ["p-cpe:/a:debian:debian_linux:otrs2", "cpe:/o:debian:debian_linux:7.0"], "id": "DEBIAN_DSA-2712.NASL", "href": "https://www.tenable.com/plugins/nessus/66937", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Debian Security Advisory DSA-2712. The text \n# itself is copyright (C) Software in the Public Interest, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(66937);\n script_version(\"1.8\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/11\");\n\n script_cve_id(\"CVE-2013-4088\");\n script_bugtraq_id(60688);\n script_xref(name:\"DSA\", value:\"2712\");\n\n script_name(english:\"Debian DSA-2712-1 : otrs2 - privilege escalation\");\n script_summary(english:\"Checks dpkg output for the updated package\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Debian host is missing a security-related update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"It was discovered that users with a valid agent login could use\ncrafted URLs to bypass access control restrictions and read tickets to\nwhich they should not have access.\n\nThe oldstable distribution (squeeze) is not affected by this problem.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://packages.debian.org/source/wheezy/otrs2\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.debian.org/security/2013/dsa-2712\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\n\"Upgrade the otrs2 packages.\n\nFor the stable distribution (wheezy), this problem has been fixed in\nversion 3.1.7+dfsg1-8+deb7u2.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:S/C:P/I:N/A:N\");\n script_set_cvss_temporal_vector(\"CVSS2#E:F/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:otrs2\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:debian:debian_linux:7.0\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2020/02/21\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2013/06/19\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2013/06/20\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2013-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Debian Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/Debian/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"debian_package.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Debian/release\")) audit(AUDIT_OS_NOT, \"Debian\");\nif (!get_kb_item(\"Host/Debian/dpkg-l\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\nif (deb_check(release:\"7.0\", prefix:\"otrs\", reference:\"3.1.7+dfsg1-8+deb7u2\")) flag++;\nif (deb_check(release:\"7.0\", prefix:\"otrs2\", reference:\"3.1.7+dfsg1-8+deb7u2\")) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:deb_report_get());\n else security_warning(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 4, "vector": "AV:N/AC:L/Au:S/C:P/I:N/A:N"}}, {"lastseen": "2021-08-26T00:51:47", "description": "The OTRS Project reports :\n\nAn attacker with a valid agent login could manipulate URLs in the ticket watch mechanism to see contents of tickets they are not permitted to see.", "cvss3": {"score": 6.5, "vector": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"}, "published": "2013-06-20T00:00:00", "type": "nessus", "title": "FreeBSD : otrs -- information disclosure (8b97d289-d8cf-11e2-a1f5-60a44c524f57)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2013-4088"], "modified": "2021-01-06T00:00:00", "cpe": ["p-cpe:/a:freebsd:freebsd:otrs", "cpe:/o:freebsd:freebsd"], "id": "FREEBSD_PKG_8B97D289D8CF11E2A1F560A44C524F57.NASL", "href": "https://www.tenable.com/plugins/nessus/66938", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from the FreeBSD VuXML database :\n#\n# Copyright 2003-2020 Jacques Vidrine and contributors\n#\n# Redistribution and use in source (VuXML) and 'compiled' forms (SGML,\n# HTML, PDF, PostScript, RTF and so forth) with or without modification,\n# are permitted provided that the following conditions are met:\n# 1. Redistributions of source code (VuXML) must retain the above\n# copyright notice, this list of conditions and the following\n# disclaimer as the first lines of this file unmodified.\n# 2. Redistributions in compiled form (transformed to other DTDs,\n# published online in any format, converted to PDF, PostScript,\n# RTF and other formats) must reproduce the above copyright\n# notice, this list of conditions and the following disclaimer\n# in the documentation and/or other materials provided with the\n# distribution.\n# \n# THIS DOCUMENTATION IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS \"AS IS\"\n# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,\n# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR\n# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS\n# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,\n# OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT\n# OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR\n# BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,\n# WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE\n# OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS DOCUMENTATION,\n# EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(66938);\n script_version(\"1.7\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/06\");\n\n script_cve_id(\"CVE-2013-4088\");\n\n script_name(english:\"FreeBSD : otrs -- information disclosure (8b97d289-d8cf-11e2-a1f5-60a44c524f57)\");\n script_summary(english:\"Checks for updated package in pkg_info output\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote FreeBSD host is missing a security-related update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"The OTRS Project reports :\n\nAn attacker with a valid agent login could manipulate URLs in the\nticket watch mechanism to see contents of tickets they are not\npermitted to see.\"\n );\n # http://www.otrs.com/en/open-source/community-news/security-advisories/security-advisory-2013-04/\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?8253323c\"\n );\n # https://vuxml.freebsd.org/freebsd/8b97d289-d8cf-11e2-a1f5-60a44c524f57.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?dde559e6\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected package.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:S/C:P/I:N/A:N\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:freebsd:freebsd:otrs\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:freebsd:freebsd\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2013/06/18\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2013/06/19\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2013/06/20\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2013-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"FreeBSD Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/FreeBSD/release\", \"Host/FreeBSD/pkg_info\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"freebsd_package.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/FreeBSD/release\")) audit(AUDIT_OS_NOT, \"FreeBSD\");\nif (!get_kb_item(\"Host/FreeBSD/pkg_info\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\n\nif (pkg_test(save_report:TRUE, pkg:\"otrs<3.2.8\")) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:pkg_report_get());\n else security_warning(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 4, "vector": "AV:N/AC:L/Au:S/C:P/I:N/A:N"}}, {"lastseen": "2021-08-19T12:55:01", "description": "The OTRS Project reports :\n\nAn attacker with a valid agent login could manipulate URLs in the ticket split mechanism to see contents of tickets and they are not permitted to see.", "cvss3": {"score": 6.5, "vector": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"}, "published": "2013-05-24T00:00:00", "type": "nessus", "title": "FreeBSD : otrs -- information disclosure (a5b24a6b-c37c-11e2-addb-60a44c524f57)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2013-3551"], "modified": "2021-01-06T00:00:00", "cpe": ["p-cpe:/a:freebsd:freebsd:otrs", "cpe:/o:freebsd:freebsd"], "id": "FREEBSD_PKG_A5B24A6BC37C11E2ADDB60A44C524F57.NASL", "href": "https://www.tenable.com/plugins/nessus/66583", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from the FreeBSD VuXML database :\n#\n# Copyright 2003-2020 Jacques Vidrine and contributors\n#\n# Redistribution and use in source (VuXML) and 'compiled' forms (SGML,\n# HTML, PDF, PostScript, RTF and so forth) with or without modification,\n# are permitted provided that the following conditions are met:\n# 1. Redistributions of source code (VuXML) must retain the above\n# copyright notice, this list of conditions and the following\n# disclaimer as the first lines of this file unmodified.\n# 2. Redistributions in compiled form (transformed to other DTDs,\n# published online in any format, converted to PDF, PostScript,\n# RTF and other formats) must reproduce the above copyright\n# notice, this list of conditions and the following disclaimer\n# in the documentation and/or other materials provided with the\n# distribution.\n# \n# THIS DOCUMENTATION IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS \"AS IS\"\n# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,\n# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR\n# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS\n# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,\n# OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT\n# OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR\n# BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,\n# WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE\n# OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS DOCUMENTATION,\n# EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(66583);\n script_version(\"1.7\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/06\");\n\n script_cve_id(\"CVE-2013-3551\");\n\n script_name(english:\"FreeBSD : otrs -- information disclosure (a5b24a6b-c37c-11e2-addb-60a44c524f57)\");\n script_summary(english:\"Checks for updated package in pkg_info output\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote FreeBSD host is missing a security-related update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"The OTRS Project reports :\n\nAn attacker with a valid agent login could manipulate URLs in the\nticket split mechanism to see contents of tickets and they are not\npermitted to see.\"\n );\n # http://www.otrs.com/en/open-source/community-news/security-advisories/security-advisory-2013-03/\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?9c9b25fe\"\n );\n # https://vuxml.freebsd.org/freebsd/a5b24a6b-c37c-11e2-addb-60a44c524f57.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?b338dc6f\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected package.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:S/C:P/I:N/A:N\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:freebsd:freebsd:otrs\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:freebsd:freebsd\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2013/05/22\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2013/05/23\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2013/05/24\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2013-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"FreeBSD Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/FreeBSD/release\", \"Host/FreeBSD/pkg_info\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"freebsd_package.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/FreeBSD/release\")) audit(AUDIT_OS_NOT, \"FreeBSD\");\nif (!get_kb_item(\"Host/FreeBSD/pkg_info\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\n\nif (pkg_test(save_report:TRUE, pkg:\"otrs<3.2.7\")) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:pkg_report_get());\n else security_warning(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 4, "vector": "AV:N/AC:L/Au:S/C:P/I:N/A:N"}}, {"lastseen": "2021-08-19T12:54:46", "description": "A vulnerability has been discovered in the Open Ticket Request System, which can be exploited by malicious users to disclose potentially sensitive information.\n\nAn attacker with a valid agent login could manipulate URLs in the ticket split mechanism to see contents of tickets they are not permitted to see.\n\nThe oldstable distribution (squeeze) is not affected by this issue.", "cvss3": {"score": 6.5, "vector": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"}, "published": "2013-05-30T00:00:00", "type": "nessus", "title": "Debian DSA-2696-1 : otrs2 - privilege escalation", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2013-3551"], "modified": "2021-01-11T00:00:00", "cpe": ["p-cpe:/a:debian:debian_linux:otrs2", "cpe:/o:debian:debian_linux:7.0"], "id": "DEBIAN_DSA-2696.NASL", "href": "https://www.tenable.com/plugins/nessus/66677", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Debian Security Advisory DSA-2696. The text \n# itself is copyright (C) Software in the Public Interest, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(66677);\n script_version(\"1.8\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/11\");\n\n script_cve_id(\"CVE-2013-3551\");\n script_bugtraq_id(60117);\n script_xref(name:\"DSA\", value:\"2696\");\n\n script_name(english:\"Debian DSA-2696-1 : otrs2 - privilege escalation\");\n script_summary(english:\"Checks dpkg output for the updated package\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Debian host is missing a security-related update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"A vulnerability has been discovered in the Open Ticket Request System,\nwhich can be exploited by malicious users to disclose potentially\nsensitive information.\n\nAn attacker with a valid agent login could manipulate URLs in the\nticket split mechanism to see contents of tickets they are not\npermitted to see.\n\nThe oldstable distribution (squeeze) is not affected by this issue.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://packages.debian.org/source/wheezy/otrs2\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.debian.org/security/2013/dsa-2696\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\n\"Upgrade the otrs2 packages.\n\nFor the stable distribution (wheezy), this problem has been fixed in\nversion 3.1.7+dfsg1-8+deb7u1.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:S/C:P/I:N/A:N\");\n script_set_cvss_temporal_vector(\"CVSS2#E:F/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:otrs2\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:debian:debian_linux:7.0\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2020/02/21\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2013/05/29\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2013/05/30\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2013-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Debian Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/Debian/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"debian_package.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Debian/release\")) audit(AUDIT_OS_NOT, \"Debian\");\nif (!get_kb_item(\"Host/Debian/dpkg-l\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\nif (deb_check(release:\"7.0\", prefix:\"otrs\", reference:\"3.1.7+dfsg1-8+deb7u1\")) flag++;\nif (deb_check(release:\"7.0\", prefix:\"otrs2\", reference:\"3.1.7+dfsg1-8+deb7u1\")) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:deb_report_get());\n else security_warning(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 4, "vector": "AV:N/AC:L/Au:S/C:P/I:N/A:N"}}, {"lastseen": "2021-08-26T00:44:45", "description": "The ticket system OTRS was updated to 3.1.18 to fix various bugs and security issues.\n\nUpdate to 3.1.18 :\n\n - OSA-2013-05, CVE-2013-4717, CVE-2013-4718 fixed.\n\n - Fixed bug#9561 - ACL restriction with CustomerID for DynamicFields at new Ticket screen not working.\n\n - Fixed bug#9425 - Wrong created date for queue view.\n\n - Fixed bug#9125 - AgentTicketSearch dialog does not expand when choosing more search criteria.\n\n - Fixed bug#8273 - Copying text in preview mode not possible.\n\n - Fixed bug#9557 - Cannot see quoted text in customer ticket zoom.\n\n - Fixed bug#9011 - GenericInterface: New value after value mapping can't be 0.\n\n - Improved parameter quoting in various places.\n\n - Fixed bug#9104 - Group permission for customer subset overwrites permissions for other customers.\n\n - Fixed bug#8719 - PasswordMin2Lower2UpperCharacters problem.\n\n - 3.1.17\n\n - Fixed OSA-2013-04, CVE-2013-4088.\n\n - Improved permission checks in AgentTicketWatcher.\n\n - Fixed bug#9503 - no connection header in soap responses.\n\n - Added parameter '-t dbonly' to backup.pl to only backup the database\n\n - Fixed bug#9491 - GenericAgent job update with dynamic fields sends Uninitialized value error.\n\n - Fixed bug#9462 - Package Management page timeout due to HTTPS disabled on Proxy connections.\n\n - 3.1.16\n\n - Fixed OSA-2013-03, CVE-2013-3551.\n\n - Updated Package Manager, that will ensure that packages to be installed meet the quality standards of OTRS Group. This is to guarantee that your package wasn’t modified, which may possibly harm your system or have an influence on the stability and performance of it. All independent package contributors will have to conduct a check of their Add-Ons by OTRS Group in order to take full advantage of the OTRS package verification.\n\n - Fixed bug#9387 - Error in a condition with dynamic fields in NotificationEvent.\n\n - Fixed bug#9286 - Ticket::ChangeOwnerToEveryone isn't functional, After a AJAX Load the setting is ignored.\n\n - Fixed bug#7518 - Escalation Notify by not working properly (follow-up fix).\n\n - Fixed bug#7478 - Got an external answer to an internal mail.\n\n - Improved permission checks in AgentTicketPhone.\n\n - Fixed bug#[9360](http://bugs.otrs.org/show_bug.cgi?id=9360) - DynamicField Names shown in CSV output.\n\n - Fixed bug#9384 - Problem with Method ServiceParentsGet of ServiceObject.\n\n - Fixed bug#9072 - Reply to email-internal includes customer users email in Cc. field.\n\n - 3.1.15\n\n - Added Malay translation.\n\n - Fixed bug#8960 - AgentTicketSearch.pm SearchProfile problem.\n\n - Fixed bug#9182 - Customer Search Function -> If you go into a ticket and go back you got not the search results.\n\n - Fixed bug#9198 - Linked search with fulltext AND additional attributes.\n\n - Fixed bug#9295 - Article dynamic field is not searchable.\n\n - Fixed bug#9312 - LinkObject permission check problem.\n\n - 3.1.14\n\n - Fixed for OSA-2013-01, CVE-2013-2625.\n\n - Fixed bug#9257 - No notifications to agents with out-of-office set but period not reached.\n\n - Improved permission checks in LinkObject.\n\n - Fixed bug#9191 - When ticket types are restricted, first available type is selected in AgentTicketActionCommon-based screens.\n\n - Updated Turkish translation, thanks to Sefer Şimşek / Network Group!\n\n - Fixed bug#9214 - IE10: impossible to open links from rich text articles.\n\n - Fixed bug#9218 - Cannot use special characters in TicketHook.\n\n - Fixed bug#9056 - Unused SysConfig option Ticket::Frontend::CustomerInfoQueueMaxSize.\n\n - Follow-up fix for bug#8533 apache will not start on Fedora.\n\n - Fixed bug#9172 - Generic Interface does not work on IIS 7.0.\n\n - Updated Czech language translation, thanks to Katerina Bubenickova!\n\n - Fixed bug#8865 - Additional empty data column in statistics CSV-Output.\n\n - update OTRS::ITSM to 3.1.10 (fix for OSA-2013-05, CVE-2013-4717, CVE-2013-4718)\n\n - update OTRS::ITSM to 3.1.9 (fix for OSA-2013-03, CVE-2013-3551)\n\n - update OTRS::ITSM to 3.1.8 (fix for OSA-2013-01, CVE-2013-2625) (fix for OSA-2013-02, CVE-2013-2637)\n\n - update to 3.1.13\n\n - http://www.otrs.com/en/open-source/community-news/releases-notes/ release-notes-otrs-help-desk-3113/\n\n - http://source.otrs.org/viewvc.cgi/otrs/CHANGES?revision=1.2260.2.206&view=markup\n\n - Fixed bug#9162 - Setting the start day of the week for the datepicker to Sunday does not work.\n\n - Fixed bug#9141 - Confused Columns in CustomerTicketSearch (ResultShort).\n\n - Fixed bug#9146 - Signed SMIME mails with altered content shows a not clear message.\n\n - Fixed bug#9145 - SMIME sign verification errors are not displayed in TicketZoom.\n\n - Fixed bug#9140 - Postmaster Filter for empty subjects does not work.\n\n - Fixed bug#9121 - Filenames with Unicode NFD are incorrectly reported as NFC by Main::DirectoryRead().\n\n - Fixed bug#9108 - Check for opened/closed tickets not working with Ticket::SubjectFormat = Right.\n\n - Fixed bug#8839 - DateChecksum followup doesn't get correctly SystemID.\n\n - Updated Russian translation, thanks to Vadim Goncharov!\n\n - Fixed bug#9101 - Not possible to create dropdown with autocomplete attribute.\n\n - Fixed bug#9096 - All services list is shown instead of only default services.\n\n - Fixed bug#8470 - otrs.GenericAgent.pl reports: Can't open '/opt/otrs/otrs_vemco/var/tmp/CacheFileStorable/DynamicF ield/f3b7e10730fb6c9cab5ae0e7f7e034f3'.\n\n - Added new translation for Spanish (Colombia), thanks to John Edisson Ortiz Roman!\n\n - Fixed bug#9054 - Link Object deletes all links under certain conditions.\n\n - Fixed bug#8944 - do not backup the cache.\n\n - Fixed bug#9057 - Generating a PDF with bin/otrs.GenerateStats.pl produces lots of warnings.\n\n - Fixed bug#8929 - Fix problems with empty ticket search results while Ticket::Frontend::AgentTicketSearch###ExtendedSearchCond ition is inactive.\n\n - Fixed bug#9042 - Add X-Spam-Score to Ticket.xml.\n\n - Fixed bug#9047 - HistoryTicketGet caches info on disk directly.\n\n - Fixed bug#8923 - Alert message shown, if parent window is reloaded while bulk action popup is open.\n\n - Fixed bug#9030 - Wrong handling of Invalid YAML in Scheduler Tasks.\n\n - Updated CKEditor to version 3.6.6.\n\n - Updated Polish translation, thanks to Pawel @ ib.pl!\n\n - Follow-up fix for bug#8805 - Cron missing as RPM dependency on RHEL. Changed dependency on 'anacron' to 'vixie-cron' on RHEL5.\n\n - Fixed bug#9020 - Generic Ticket Connector does not support attachments with ContentType without charset.\n\n - Fixed bug#8545 - Attachment download not possible if pop up of another action is open.\n\n - Fixed bug#9009 - Empty Multiselect Dynamic Fields provokes an error.\n\n - Fixed bug#8589 - Bulk-Action not possible for single ticket.\n\n - Fixed bug#7198 - Broken repository selection width in Package Manager.\n\n - Fixed bug#8457 - Error if accessing AgentTicketSearch from AgentTicketPhone in IE8.\n\n - Fixed bug#8695 - Table head of Customer Ticket History does not resize on window resize.\n\n - Fixed bug#8533 - Apache will not start if you use mod_perl on Fedora 16 or 17.\n\n - Fixed bug#8974 - Event Based Notification does not populate REALNAME with Customer User data.\n\n - update to 3.1.12\n\n - Fixed bug#8933 - ArticleStorageInit permission check problem.\n\n - Fixed bug#8763 - Please add charset conversion for customer companies.\n\n - Fixed bug#1970 - Email attachments of type .msg (Outlook-Message) are converted.\n\n - Fixed bug#8955 - Init script might fail on SUSE.\n\n - Fixed bug#8936 - Ticket close date is empty when ticket is created in closed state.\n\n - Fixed bug#8937 - '$' should be escaped in interpolated strings when JavaScript is meant.\n\n - Fixed bug#8919 - Customer interface search results:\n ticket can only be accessed via ticket number and subject.\n\n - Fixed bug#8850 - CustomerTicketOverview - MouseOver Age isn't always correct.\n\n - Fixed bug#8868 - Event Based Notification problem saving 'text' Dynamic Fields.\n\n - Fixed bug#8914 - Syntax error in hash loop in TicketGet operation.\n\n - Fixed bug#8749 - CustomerFrontend: missing dynamicfield in search results.\n\n - Fixed bug#8873 - Bad example of customization of 'static' dynamic fields in AgentTicketOverviewSmall.\n\n - Fixed bug#8791 - IMAPTLS fails with some Microsoft Exchange servers.\n\n - Fixed bug#8841 - Search for Dynamic Fields shows all tickets (on 'enter' key pressed).\n\n - Fixed bug#8861 - Ticket History overlaid calender choice function.\n\n - Fixed bug#8862 - GI debugger GUI does not show SOAP XML tags correctly.\n\n - Fixed bug#8566 - Cannot download attachment if filename has character #.\n\n - Fixed bug#8833 - Article table in TicketZoom does not scroll correctly.\n\n - Fixed bug#8673 - Richtext-Editor popups broken on Customer-Interface.\n\n - Fixed bug#8859 - Package upgrade does not work if an installed testpackage should be upgraded with a newer regular package.\n\n - Fixed bug#8678 - 'WidgetAction Toggle' is always shown as 'Expanded' when nesting elements\n\n - Fixed bug#8378 - Validation fails if the ID of the element contains a dot (.) or a colon (:)\n\n - Fixed bug#8847 - Inline PGP message description routine does not add any info, thanks to IB Development Team.\n\n - Fixed bug#8848 - AgentTicketEmail does not preserve PGP Signatures set if attachment is added.\n\n - Fixed bug#8149 - Wrong handling of subject when SubjectFormat=right.\n\n - Updated Polish translation, thanks to Pawel!\n\n - Fixed bug#8820 - Service rcotrs restart fails because a race condition happens.\n\n - Fixed bug#8819 - Syntax error (stop crontab command) in SuSE rc script.\n\n - Removed auto cleanup of expired sessions in CreateSessionID() to improve the scalability of the hole system.\n\n - Fixed bug#8667 - TicketSplit does not use QueueID of old Ticket for ACL Checking.\n\n - Fixed bug#8780 - 508 Compliance: Text descriptions of 'Responsible Tickets' and 'Locked Tickets' links are insufficient for screen reader users.\n\n - Fixed bug#8812 - Encrypted email doesn't see properly in Outlook.\n\n - Fixed bug#8214 - OTRS Init script on Red Hat fails to check scheduler.\n\n - Fixed bug#8850 - Cron missing as RPM dependency on Red Hat Enterprise Linux.\n\n - Fixed bug#7274 - Ticket QueueView sorts by priority on first page but subsequent pages sort incorrectly by Age.\n\n - Fixed bug#8792 - TriggerEscalationStopEvents logs as loglevel 'error'.\n\n - Fixed bug#8743 - AgentTicketCompose.pm creates To, CC, BCC filelds without spaces after comma.\n\n - Fixed bug#8606 - Escalation notifications should not be sent to agents who are set out-of-office.\n\n - Fixed bug#8740 - backup.pl: insufficient handling of system() return values.\n\n - Fixed bug#8622 - Storing a new GI Invoker or Operation with an existing name doesn't complain anything.\n\n - Fixed bug#8770 - AJAX Removes Default Options (follow-up fix).\n\n - Improved caching for Services and Service Lists.\n\n - Update ITSM to 3.1.7\n\n - News\n\n - In AgentTicketZoom the service and the sla are now shown as links to the service zoom / sla zoom screens.\n\n - Updated Polish translation, thanks to Pawel!\n\n - Added feature in bin/otrs.ITSMConfigItemDelete.pl script to delete config items by class together with the deployment state.\n\n - Added CustomerCompany field type that allows to link CI's with Customer Companies registered in OTRS.\n\n - Enhanced Import/Export screen to show a summary after importing.\n\n - Added new optional sysconfig option to check if config item names are unique.\n\n - Added attachment support for ITSM config items. This will replace the OTRS FeatureAddOn OTRSCIAttachment.\n Please uninstall this FeatureAddon BEFORE you upgrade to OTRS::ITSM 3.1.7 (no attachment data will be lost)!\n\n - Bug Fixes\n\n - Bug# 5928 - Print PDF: Newline not interpreted.\n\n - Bug# 8723 - Setting the planned start and planned end time to the same value causes an error.\n\n - Bug# 8785 - Poor performance of ServiceGet with many child services.\n\n - Bug# 8626 - AgentTicketAddtlITSMField, Ticket states set to first state after reload.\n\n - Bug# 8852 - No Impact and Criticality in CustomerTicketZoom.\n\n - Bug# 7786 - Search by 'type' not displaying correct results from page 2 on.\n\n - Bug# 8804 - Reorder of workorders based on actual startime.\n\n - Bug# 8686 - CI-Search can not handle > 1000 CIs per class\n\n - Bug# 8863 - Problem with ChangeManagement DropDowns in Conditions Mask.\n\n - Bug# 8834 - Broken changes created from template when no time offset.\n\n - Bug# 8830 - CI version header should be clickable in all columns.\n\n - Bug# 8613 - Wrong date if a workorder has been created from a template.\n\n - Bug# 8881 - Searching for a config item number = 0 or a config item name = 0 (without wildcards) finds results where it should not.\n\n - Bug# 8882 - Error message from ToolBarMyCAB.\n\n - Bug# 8614 - Update agent notification doesn't contain agent name.\n\n - Bug# 8615 - Notification not sent for ChangeStateUpdate to pending PIR.\n\n - Bug# 7508 - Autocomplete uses milliseconds rather than seconds.\n\n - rebase perm patch\n\n - fix changes file", "cvss3": {"score": 6.5, "vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"}, "published": "2014-06-13T00:00:00", "type": "nessus", "title": "openSUSE Security Update : otrs (openSUSE-SU-2013:1338-1)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2013-2625", "CVE-2013-2637", "CVE-2013-3551", "CVE-2013-4088", "CVE-2013-4717", "CVE-2013-4718"], "modified": "2021-01-19T00:00:00", "cpe": ["p-cpe:/a:novell:opensuse:otrs", "p-cpe:/a:novell:opensuse:otrs-itsm", "cpe:/o:novell:opensuse:12.2", "cpe:/o:novell:opensuse:12.3"], "id": "OPENSUSE-2013-639.NASL", "href": "https://www.tenable.com/plugins/nessus/75111", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from openSUSE Security Update openSUSE-2013-639.\n#\n# The text description of this plugin is (C) SUSE LLC.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(75111);\n script_version(\"1.8\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/19\");\n\n script_cve_id(\"CVE-2013-2625\", \"CVE-2013-2637\", \"CVE-2013-3551\", \"CVE-2013-4088\", \"CVE-2013-4717\", \"CVE-2013-4718\");\n\n script_name(english:\"openSUSE Security Update : otrs (openSUSE-SU-2013:1338-1)\");\n script_summary(english:\"Check for the openSUSE-2013-639 patch\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote openSUSE host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"The ticket system OTRS was updated to 3.1.18 to fix various bugs and\nsecurity issues.\n\nUpdate to 3.1.18 :\n\n - OSA-2013-05, CVE-2013-4717, CVE-2013-4718 fixed.\n\n - Fixed bug#9561 - ACL restriction with CustomerID for\n DynamicFields at new Ticket screen not working.\n\n - Fixed bug#9425 - Wrong created date for queue view.\n\n - Fixed bug#9125 - AgentTicketSearch dialog does not\n expand when choosing more search criteria.\n\n - Fixed bug#8273 - Copying text in preview mode not\n possible.\n\n - Fixed bug#9557 - Cannot see quoted text in customer\n ticket zoom.\n\n - Fixed bug#9011 - GenericInterface: New value after value\n mapping can't be 0.\n\n - Improved parameter quoting in various places.\n\n - Fixed bug#9104 - Group permission for customer subset\n overwrites permissions for other customers.\n\n - Fixed bug#8719 - PasswordMin2Lower2UpperCharacters\n problem.\n\n - 3.1.17\n\n - Fixed OSA-2013-04, CVE-2013-4088.\n\n - Improved permission checks in AgentTicketWatcher.\n\n - Fixed bug#9503 - no connection header in soap responses.\n\n - Added parameter '-t dbonly' to backup.pl to only backup\n the database\n\n - Fixed bug#9491 - GenericAgent job update with dynamic\n fields sends Uninitialized value error.\n\n - Fixed bug#9462 - Package Management page timeout due to\n HTTPS disabled on Proxy connections.\n\n - 3.1.16\n\n - Fixed OSA-2013-03, CVE-2013-3551.\n\n - Updated Package Manager, that will ensure that packages\n to be installed meet the quality standards of OTRS\n Group. This is to guarantee that your package\n wasn’t modified, which may possibly harm your\n system or have an influence on the stability and\n performance of it. All independent package contributors\n will have to conduct a check of their Add-Ons by OTRS\n Group in order to take full advantage of the OTRS\n package verification.\n\n - Fixed bug#9387 - Error in a condition with dynamic\n fields in NotificationEvent.\n\n - Fixed bug#9286 - Ticket::ChangeOwnerToEveryone isn't\n functional, After a AJAX Load the setting is ignored.\n\n - Fixed bug#7518 - Escalation Notify by not working\n properly (follow-up fix).\n\n - Fixed bug#7478 - Got an external answer to an internal\n mail.\n\n - Improved permission checks in AgentTicketPhone.\n\n - Fixed\n bug#[9360](http://bugs.otrs.org/show_bug.cgi?id=9360) -\n DynamicField Names shown in CSV output.\n\n - Fixed bug#9384 - Problem with Method ServiceParentsGet\n of ServiceObject.\n\n - Fixed bug#9072 - Reply to email-internal includes\n customer users email in Cc. field.\n\n - 3.1.15\n\n - Added Malay translation.\n\n - Fixed bug#8960 - AgentTicketSearch.pm SearchProfile\n problem.\n\n - Fixed bug#9182 - Customer Search Function -> If you go\n into a ticket and go back you got not the search\n results.\n\n - Fixed bug#9198 - Linked search with fulltext AND\n additional attributes.\n\n - Fixed bug#9295 - Article dynamic field is not\n searchable.\n\n - Fixed bug#9312 - LinkObject permission check problem.\n\n - 3.1.14\n\n - Fixed for OSA-2013-01, CVE-2013-2625.\n\n - Fixed bug#9257 - No notifications to agents with\n out-of-office set but period not reached.\n\n - Improved permission checks in LinkObject.\n\n - Fixed bug#9191 - When ticket types are restricted, first\n available type is selected in\n AgentTicketActionCommon-based screens.\n\n - Updated Turkish translation, thanks to Sefer\n Şimşek / Network Group!\n\n - Fixed bug#9214 - IE10: impossible to open links from\n rich text articles.\n\n - Fixed bug#9218 - Cannot use special characters in\n TicketHook.\n\n - Fixed bug#9056 - Unused SysConfig option\n Ticket::Frontend::CustomerInfoQueueMaxSize.\n\n - Follow-up fix for bug#8533 apache will not start on\n Fedora.\n\n - Fixed bug#9172 - Generic Interface does not work on IIS\n 7.0.\n\n - Updated Czech language translation, thanks to Katerina\n Bubenickova!\n\n - Fixed bug#8865 - Additional empty data column in\n statistics CSV-Output.\n\n - update OTRS::ITSM to 3.1.10 (fix for OSA-2013-05,\n CVE-2013-4717, CVE-2013-4718)\n\n - update OTRS::ITSM to 3.1.9 (fix for OSA-2013-03,\n CVE-2013-3551)\n\n - update OTRS::ITSM to 3.1.8 (fix for OSA-2013-01,\n CVE-2013-2625) (fix for OSA-2013-02, CVE-2013-2637)\n\n - update to 3.1.13\n\n - http://www.otrs.com/en/open-source/community-news/releases-notes/\nrelease-notes-otrs-help-desk-3113/\n\n - http://source.otrs.org/viewvc.cgi/otrs/CHANGES?revision=1.2260.2.206&view=markup\n\n - Fixed bug#9162 - Setting the start day of the week for\n the datepicker to Sunday does not work.\n\n - Fixed bug#9141 - Confused Columns in\n CustomerTicketSearch (ResultShort).\n\n - Fixed bug#9146 - Signed SMIME mails with altered content\n shows a not clear message.\n\n - Fixed bug#9145 - SMIME sign verification errors are not\n displayed in TicketZoom.\n\n - Fixed bug#9140 - Postmaster Filter for empty subjects\n does not work.\n\n - Fixed bug#9121 - Filenames with Unicode NFD are\n incorrectly reported as NFC by Main::DirectoryRead().\n\n - Fixed bug#9108 - Check for opened/closed tickets not\n working with Ticket::SubjectFormat = Right.\n\n - Fixed bug#8839 - DateChecksum followup doesn't get\n correctly SystemID.\n\n - Updated Russian translation, thanks to Vadim Goncharov!\n\n - Fixed bug#9101 - Not possible to create dropdown with\n autocomplete attribute.\n\n - Fixed bug#9096 - All services list is shown instead of\n only default services.\n\n - Fixed bug#8470 - otrs.GenericAgent.pl reports: Can't\n open\n '/opt/otrs/otrs_vemco/var/tmp/CacheFileStorable/DynamicF\n ield/f3b7e10730fb6c9cab5ae0e7f7e034f3'.\n\n - Added new translation for Spanish (Colombia), thanks to\n John Edisson Ortiz Roman!\n\n - Fixed bug#9054 - Link Object deletes all links under\n certain conditions.\n\n - Fixed bug#8944 - do not backup the cache.\n\n - Fixed bug#9057 - Generating a PDF with\n bin/otrs.GenerateStats.pl produces lots of warnings.\n\n - Fixed bug#8929 - Fix problems with empty ticket search\n results while\n Ticket::Frontend::AgentTicketSearch###ExtendedSearchCond\n ition is inactive.\n\n - Fixed bug#9042 - Add X-Spam-Score to Ticket.xml.\n\n - Fixed bug#9047 - HistoryTicketGet caches info on disk\n directly.\n\n - Fixed bug#8923 - Alert message shown, if parent window\n is reloaded while bulk action popup is open.\n\n - Fixed bug#9030 - Wrong handling of Invalid YAML in\n Scheduler Tasks.\n\n - Updated CKEditor to version 3.6.6.\n\n - Updated Polish translation, thanks to Pawel @ ib.pl!\n\n - Follow-up fix for bug#8805 - Cron missing as RPM\n dependency on RHEL. Changed dependency on 'anacron' to\n 'vixie-cron' on RHEL5.\n\n - Fixed bug#9020 - Generic Ticket Connector does not\n support attachments with ContentType without charset.\n\n - Fixed bug#8545 - Attachment download not possible if pop\n up of another action is open.\n\n - Fixed bug#9009 - Empty Multiselect Dynamic Fields\n provokes an error.\n\n - Fixed bug#8589 - Bulk-Action not possible for single\n ticket.\n\n - Fixed bug#7198 - Broken repository selection width in\n Package Manager.\n\n - Fixed bug#8457 - Error if accessing AgentTicketSearch\n from AgentTicketPhone in IE8.\n\n - Fixed bug#8695 - Table head of Customer Ticket History\n does not resize on window resize.\n\n - Fixed bug#8533 - Apache will not start if you use\n mod_perl on Fedora 16 or 17.\n\n - Fixed bug#8974 - Event Based Notification does not\n populate REALNAME with Customer User data.\n\n - update to 3.1.12\n\n - Fixed bug#8933 - ArticleStorageInit permission check\n problem.\n\n - Fixed bug#8763 - Please add charset conversion for\n customer companies.\n\n - Fixed bug#1970 - Email attachments of type .msg\n (Outlook-Message) are converted.\n\n - Fixed bug#8955 - Init script might fail on SUSE.\n\n - Fixed bug#8936 - Ticket close date is empty when ticket\n is created in closed state.\n\n - Fixed bug#8937 - '$' should be escaped in interpolated\n strings when JavaScript is meant.\n\n - Fixed bug#8919 - Customer interface search results:\n ticket can only be accessed via ticket number and\n subject.\n\n - Fixed bug#8850 - CustomerTicketOverview - MouseOver Age\n isn't always correct.\n\n - Fixed bug#8868 - Event Based Notification problem saving\n 'text' Dynamic Fields.\n\n - Fixed bug#8914 - Syntax error in hash loop in TicketGet\n operation.\n\n - Fixed bug#8749 - CustomerFrontend: missing dynamicfield\n in search results.\n\n - Fixed bug#8873 - Bad example of customization of\n 'static' dynamic fields in AgentTicketOverviewSmall.\n\n - Fixed bug#8791 - IMAPTLS fails with some Microsoft\n Exchange servers.\n\n - Fixed bug#8841 - Search for Dynamic Fields shows all\n tickets (on 'enter' key pressed).\n\n - Fixed bug#8861 - Ticket History overlaid calender choice\n function.\n\n - Fixed bug#8862 - GI debugger GUI does not show SOAP XML\n tags correctly.\n\n - Fixed bug#8566 - Cannot download attachment if filename\n has character #.\n\n - Fixed bug#8833 - Article table in TicketZoom does not\n scroll correctly.\n\n - Fixed bug#8673 - Richtext-Editor popups broken on\n Customer-Interface.\n\n - Fixed bug#8859 - Package upgrade does not work if an\n installed testpackage should be upgraded with a newer\n regular package.\n\n - Fixed bug#8678 - 'WidgetAction Toggle' is always shown\n as 'Expanded' when nesting elements\n\n - Fixed bug#8378 - Validation fails if the ID of the\n element contains a dot (.) or a colon (:)\n\n - Fixed bug#8847 - Inline PGP message description routine\n does not add any info, thanks to IB Development Team.\n\n - Fixed bug#8848 - AgentTicketEmail does not preserve PGP\n Signatures set if attachment is added.\n\n - Fixed bug#8149 - Wrong handling of subject when\n SubjectFormat=right.\n\n - Updated Polish translation, thanks to Pawel!\n\n - Fixed bug#8820 - Service rcotrs restart fails because a\n race condition happens.\n\n - Fixed bug#8819 - Syntax error (stop crontab command) in\n SuSE rc script.\n\n - Removed auto cleanup of expired sessions in\n CreateSessionID() to improve the scalability of the hole\n system.\n\n - Fixed bug#8667 - TicketSplit does not use QueueID of old\n Ticket for ACL Checking.\n\n - Fixed bug#8780 - 508 Compliance: Text descriptions of\n 'Responsible Tickets' and 'Locked Tickets' links are\n insufficient for screen reader users.\n\n - Fixed bug#8812 - Encrypted email doesn't see properly in\n Outlook.\n\n - Fixed bug#8214 - OTRS Init script on Red Hat fails to\n check scheduler.\n\n - Fixed bug#8850 - Cron missing as RPM dependency on Red\n Hat Enterprise Linux.\n\n - Fixed bug#7274 - Ticket QueueView sorts by priority on\n first page but subsequent pages sort incorrectly by Age.\n\n - Fixed bug#8792 - TriggerEscalationStopEvents logs as\n loglevel 'error'.\n\n - Fixed bug#8743 - AgentTicketCompose.pm creates To, CC,\n BCC filelds without spaces after comma.\n\n - Fixed bug#8606 - Escalation notifications should not be\n sent to agents who are set out-of-office.\n\n - Fixed bug#8740 - backup.pl: insufficient handling of\n system() return values.\n\n - Fixed bug#8622 - Storing a new GI Invoker or Operation\n with an existing name doesn't complain anything.\n\n - Fixed bug#8770 - AJAX Removes Default Options (follow-up\n fix).\n\n - Improved caching for Services and Service Lists.\n\n - Update ITSM to 3.1.7\n\n - News\n\n - In AgentTicketZoom the service and the sla are now shown\n as links to the service zoom / sla zoom screens.\n\n - Updated Polish translation, thanks to Pawel!\n\n - Added feature in bin/otrs.ITSMConfigItemDelete.pl script\n to delete config items by class together with the\n deployment state.\n\n - Added CustomerCompany field type that allows to link\n CI's with Customer Companies registered in OTRS.\n\n - Enhanced Import/Export screen to show a summary after\n importing.\n\n - Added new optional sysconfig option to check if config\n item names are unique.\n\n - Added attachment support for ITSM config items. This\n will replace the OTRS FeatureAddOn OTRSCIAttachment.\n Please uninstall this FeatureAddon BEFORE you upgrade to\n OTRS::ITSM 3.1.7 (no attachment data will be lost)!\n\n - Bug Fixes\n\n - Bug# 5928 - Print PDF: Newline not interpreted.\n\n - Bug# 8723 - Setting the planned start and planned end\n time to the same value causes an error.\n\n - Bug# 8785 - Poor performance of ServiceGet with many\n child services.\n\n - Bug# 8626 - AgentTicketAddtlITSMField, Ticket states set\n to first state after reload.\n\n - Bug# 8852 - No Impact and Criticality in\n CustomerTicketZoom.\n\n - Bug# 7786 - Search by 'type' not displaying correct\n results from page 2 on.\n\n - Bug# 8804 - Reorder of workorders based on actual\n startime.\n\n - Bug# 8686 - CI-Search can not handle > 1000 CIs per\n class\n\n - Bug# 8863 - Problem with ChangeManagement DropDowns in\n Conditions Mask.\n\n - Bug# 8834 - Broken changes created from template when no\n time offset.\n\n - Bug# 8830 - CI version header should be clickable in all\n columns.\n\n - Bug# 8613 - Wrong date if a workorder has been created\n from a template.\n\n - Bug# 8881 - Searching for a config item number = 0 or a\n config item name = 0 (without wildcards) finds results\n where it should not.\n\n - Bug# 8882 - Error message from ToolBarMyCAB.\n\n - Bug# 8614 - Update agent notification doesn't contain\n agent name.\n\n - Bug# 8615 - Notification not sent for ChangeStateUpdate\n to pending PIR.\n\n - Bug# 7508 - Autocomplete uses milliseconds rather than\n seconds.\n\n - rebase perm patch\n\n - fix changes file\"\n );\n # http://bugs.otrs.org/show_bug.cgi?id=9360\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugs.otrs.org/show_bug.cgi?id=9360\"\n );\n # http://source.otrs.org/viewvc.cgi/otrs/CHANGES?revision=1.2260.2.206&view=markup\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?b0b979b8\"\n );\n # http://www.otrs.com/en/open-source/community-news/releases-notes/\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://otrs.com\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.novell.com/show_bug.cgi?id=828850\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://lists.opensuse.org/opensuse-updates/2013-08/msg00027.html\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected otrs packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:N\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:otrs\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:otrs-itsm\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:opensuse:12.2\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:opensuse:12.3\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2019/11/27\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2013/08/02\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2014/06/13\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2014-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"SuSE Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release =~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"openSUSE\");\nif (release !~ \"^(SUSE12\\.2|SUSE12\\.3)$\") audit(AUDIT_OS_RELEASE_NOT, \"openSUSE\", \"12.2 / 12.3\", release);\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\n\nflag = 0;\n\nif ( rpm_check(release:\"SUSE12.2\", reference:\"otrs-3.1.18-20.17.1\") ) flag++;\nif ( rpm_check(release:\"SUSE12.2\", reference:\"otrs-itsm-3.1.10-20.17.1\") ) flag++;\nif ( rpm_check(release:\"SUSE12.3\", reference:\"otrs-3.1.18-26.5.1\") ) flag++;\nif ( rpm_check(release:\"SUSE12.3\", reference:\"otrs-itsm-3.1.10-26.5.1\") ) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());\n else security_warning(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"otrs\");\n}\n", "cvss": {"score": 6.4, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:N"}}, {"lastseen": "2022-03-27T18:35:38", "description": "It was discovered that otrs2, the Open Ticket Request System, does not properly sanitise user-supplied data that is used on SQL queries. An attacker with a valid agent login could exploit this issue to craft SQL queries by injecting arbitrary SQL code through manipulated URLs.", "cvss3": {"score": null, "vector": null}, "published": "2013-08-05T00:00:00", "type": "nessus", "title": "Debian DSA-2733-1 : otrs2 - SQL injection", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2012-4751", "CVE-2013-2625", "CVE-2013-4088", "CVE-2013-4717"], "modified": "2021-01-11T00:00:00", "cpe": ["p-cpe:/a:debian:debian_linux:otrs2", "cpe:/o:debian:debian_linux:6.0", "cpe:/o:debian:debian_linux:7.0"], "id": "DEBIAN_DSA-2733.NASL", "href": "https://www.tenable.com/plugins/nessus/69197", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Debian Security Advisory DSA-2733. The text \n# itself is copyright (C) Software in the Public Interest, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(69197);\n script_version(\"1.10\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/11\");\n\n script_cve_id(\"CVE-2013-4717\");\n script_bugtraq_id(61037);\n script_xref(name:\"DSA\", value:\"2733\");\n\n script_name(english:\"Debian DSA-2733-1 : otrs2 - SQL injection\");\n script_summary(english:\"Checks dpkg output for the updated package\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Debian host is missing a security-related update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"It was discovered that otrs2, the Open Ticket Request System, does not\nproperly sanitise user-supplied data that is used on SQL queries. An\nattacker with a valid agent login could exploit this issue to craft\nSQL queries by injecting arbitrary SQL code through manipulated URLs.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2012-4751\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2013-2625\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2013-4088\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://packages.debian.org/source/squeeze/otrs2\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://packages.debian.org/source/wheezy/otrs2\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.debian.org/security/2013/dsa-2733\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\n\"Upgrade the otrs2 packages.\n\nFor the oldstable distribution (squeeze), this problem has been fixed\nin version 2.4.9+dfsg1-3+squeeze4. This update also provides fixes for\nCVE-2012-4751, CVE-2013-2625 and CVE-2013-4088, which were all fixed\nfor stable already.\n\nFor the stable distribution (wheezy), this problem has been fixed in\nversion 3.1.7+dfsg1-8+deb7u3.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:L/AC:L/Au:S/C:N/I:C/A:N\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:otrs2\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:debian:debian_linux:6.0\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:debian:debian_linux:7.0\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2013/08/02\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2013/08/05\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2013-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Debian Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/Debian/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"debian_package.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Debian/release\")) audit(AUDIT_OS_NOT, \"Debian\");\nif (!get_kb_item(\"Host/Debian/dpkg-l\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\nif (deb_check(release:\"6.0\", prefix:\"otrs2\", reference:\"2.4.9+dfsg1-3+squeeze4\")) flag++;\nif (deb_check(release:\"7.0\", prefix:\"otrs\", reference:\"3.1.7+dfsg1-8+deb7u3\")) flag++;\nif (deb_check(release:\"7.0\", prefix:\"otrs2\", reference:\"3.1.7+dfsg1-8+deb7u3\")) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:deb_report_get());\n else security_warning(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 4.6, "vector": "AV:L/AC:L/Au:S/C:N/I:C/A:N"}}], "securityvulns": [{"lastseen": "2018-08-31T11:10:48", "description": "\r\n\r\n-----BEGIN PGP SIGNED MESSAGE-----\r\nHash: SHA1\r\n\r\n _______________________________________________________________________\r\n\r\n Mandriva Linux Security Advisory MDVSA-2013:188\r\n http://www.mandriva.com/en/support/security/\r\n _______________________________________________________________________\r\n\r\n Package : otrs\r\n Date : July 2, 2013\r\n Affected: Business Server 1.0\r\n _______________________________________________________________________\r\n\r\n Problem Description:\r\n\r\n Updated otrs package fixes security vulnerabilities:\r\n \r\n An attacker with a valid agent login could manipulate URLs in the\r\n ticket watch mechanism to see contents of tickets they are not\r\n permitted to see (CVE-2013-3551, CVE-2013-4088).\r\n _______________________________________________________________________\r\n\r\n References:\r\n\r\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-3551\r\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4088\r\n http://advisories.mageia.org/MGASA-2013-0196.html\r\n _______________________________________________________________________\r\n\r\n Updated Packages:\r\n\r\n Mandriva Business Server 1/X86_64:\r\n 2434c569f54d99ad362b658fcfd915fe mbs1/x86_64/otrs-3.2.8-1.mbs1.noarch.rpm \r\n 9a95a42ea0b69ee31446191b87799bc1 mbs1/SRPMS/otrs-3.2.8-1.mbs1.src.rpm\r\n _______________________________________________________________________\r\n\r\n To upgrade automatically use MandrivaUpdate or urpmi. The verification\r\n of md5 checksums and GPG signatures is performed automatically for you.\r\n\r\n All packages are signed by Mandriva for security. You can obtain the\r\n GPG public key of the Mandriva Security Team by executing:\r\n\r\n gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98\r\n\r\n You can view other update advisories for Mandriva Linux at:\r\n\r\n http://www.mandriva.com/en/support/security/advisories/\r\n\r\n If you want to report vulnerabilities, please contact\r\n\r\n security_(at)_mandriva.com\r\n _______________________________________________________________________\r\n\r\n Type Bits/KeyID Date User ID\r\n pub 1024D/22458A98 2000-07-10 Mandriva Security Team\r\n <security*mandriva.com>\r\n-----BEGIN PGP SIGNATURE-----\r\nVersion: GnuPG v1.4.12 (GNU/Linux)\r\n\r\niD8DBQFR0pm5mqjQ0CJFipgRAnNdAKCVV+NGxcvPohGPzeunxtg9iwlwmQCg5+VJ\r\nO7cUQCyrZY9uUsY8Kf4r8V8=\r\n=3c/S\r\n-----END PGP SIGNATURE-----\r\n", "edition": 1, "cvss3": {}, "published": "2013-07-15T00:00:00", "title": "[ MDVSA-2013:188 ] otrs", "type": "securityvulns", "bulletinFamily": "software", "cvss2": {}, "cvelist": ["CVE-2013-3551", "CVE-2013-4088"], "modified": "2013-07-15T00:00:00", "id": "SECURITYVULNS:DOC:29576", "href": "https://vulners.com/securityvulns/SECURITYVULNS:DOC:29576", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2021-06-08T18:46:17", "description": "PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc.", "edition": 2, "cvss3": {}, "published": "2013-07-15T00:00:00", "title": "Web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)", "type": "securityvulns", "bulletinFamily": "software", "cvss2": {}, "cvelist": ["CVE-2013-4621", "CVE-2013-3635", "CVE-2013-3639", "CVE-2013-3514", "CVE-2013-3729", "CVE-2012-6458", "CVE-2013-3551", "CVE-2013-3294", "CVE-2013-3728", "CVE-2013-3295", "CVE-2013-3637", "CVE-2013-2624", "CVE-2013-4088", "CVE-2013-3515", "CVE-2013-3727", "CVE-2013-3636", "CVE-2013-1777", "CVE-2013-2621", "CVE-2013-3739", "CVE-2013-2623", "CVE-2013-3638"], "modified": "2013-07-15T00:00:00", "id": "SECURITYVULNS:VULN:13172", "href": "https://vulners.com/securityvulns/SECURITYVULNS:VULN:13172", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}], "openvas": [{"lastseen": "2020-03-03T20:58:01", "description": "It was discovered that users with a valid agent login could use\ncrafted URLs to bypass access control restrictions and read tickets to\nwhich they should not have access.\n\nThe oldstable distribution (squeeze) is not affected by this problem.", "cvss3": {}, "published": "2013-06-19T00:00:00", "type": "openvas", "title": "Debian Security Advisory DSA 2712-1 (otrs2 - privilege escalation)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2013-4088"], "modified": "2020-03-02T00:00:00", "id": "OPENVAS:1361412562310892712", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310892712", "sourceData": "# OpenVAS Vulnerability Test\n# Auto-generated from advisory DSA 2712-1 using nvtgen 1.0\n# Script version: 1.0\n#\n# Author:\n# Greenbone Networks\n#\n# Copyright:\n# Copyright (C) 2013 Greenbone Networks GmbH http://greenbone.net\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.892712\");\n script_version(\"2020-03-02T07:51:06+0000\");\n script_cve_id(\"CVE-2013-4088\");\n script_name(\"Debian Security Advisory DSA 2712-1 (otrs2 - privilege escalation)\");\n script_tag(name:\"last_modification\", value:\"2020-03-02 07:51:06 +0000 (Mon, 02 Mar 2020)\");\n script_tag(name:\"creation_date\", value:\"2013-06-19 00:00:00 +0200 (Wed, 19 Jun 2013)\");\n script_tag(name:\"cvss_base\", value:\"4.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:S/C:P/I:N/A:N\");\n\n script_xref(name:\"URL\", value:\"http://www.debian.org/security/2013/dsa-2712.html\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2013 Greenbone Networks GmbH http://greenbone.net\");\n script_family(\"Debian Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/debian_linux\", \"ssh/login/packages\", re:\"ssh/login/release=DEB7\");\n script_tag(name:\"affected\", value:\"otrs2 on Debian Linux\");\n script_tag(name:\"solution\", value:\"For the stable distribution (wheezy), this problem has been fixed in\nversion 3.1.7+dfsg1-8+deb7u2.\n\nFor the unstable distribution (sid), this problem has been fixed in\nversion 3.2.8-1.\n\nWe recommend that you upgrade your otrs2 packages.\");\n script_tag(name:\"summary\", value:\"It was discovered that users with a valid agent login could use\ncrafted URLs to bypass access control restrictions and read tickets to\nwhich they should not have access.\n\nThe oldstable distribution (squeeze) is not affected by this problem.\");\n script_tag(name:\"vuldetect\", value:\"This check tests the installed software version using the apt package manager.\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-deb.inc\");\n\nres = \"\";\nreport = \"\";\nif((res = isdpkgvuln(pkg:\"otrs\", ver:\"3.1.7+dfsg1-8+deb7u2\", rls:\"DEB7\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"otrs2\", ver:\"3.1.7+dfsg1-8+deb7u2\", rls:\"DEB7\")) != NULL) {\n report += res;\n}\n\nif(report != \"\") {\n security_message(data:report);\n} else if(__pkg_match) {\n exit(99);\n}\n", "cvss": {"score": 4.0, "vector": "AV:N/AC:L/Au:S/C:P/I:N/A:N"}}, {"lastseen": "2020-03-03T20:58:01", "description": "This host is installed with OTRS (Open Ticket Request System) and is prone to\nsecurity bypass vulnerability.", "cvss3": {}, "published": "2013-09-22T00:00:00", "type": "openvas", "title": "OTRS Ticket Watch Security Bypass Vulnerability", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2013-4088"], "modified": "2020-03-02T00:00:00", "id": "OPENVAS:1361412562310803943", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310803943", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# OTRS Ticket Watch Security Bypass Vulnerability\n#\n# Authors:\n# Shashi Kiran N <nskiran@secpod.com>\n#\n# Copyright:\n# Copyright (C) 2013 Greenbone Networks GmbH\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\nCPE = \"cpe:/a:otrs:otrs\";\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.803943\");\n script_version(\"2020-03-02T07:51:06+0000\");\n script_cve_id(\"CVE-2013-4088\");\n script_bugtraq_id(60688);\n script_tag(name:\"cvss_base\", value:\"4.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:S/C:P/I:N/A:N\");\n script_tag(name:\"qod_type\", value:\"remote_banner_unreliable\");\n script_tag(name:\"last_modification\", value:\"2020-03-02 07:51:06 +0000 (Mon, 02 Mar 2020)\");\n script_tag(name:\"creation_date\", value:\"2013-09-22 10:18:31 +0530 (Sun, 22 Sep 2013)\");\n script_name(\"OTRS Ticket Watch Security Bypass Vulnerability\");\n\n\n script_tag(name:\"impact\", value:\"Successful exploitation will allow remote authenticated users to bypass\nintended security restriction and obtain sensitive information.\");\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present on the target host.\");\n script_tag(name:\"insight\", value:\"An error exists in application which fails properly verifying permissions\nwhen accessing tickets via the ticket watch mechanism\");\n script_tag(name:\"solution\", value:\"Upgrade to OTRS (Open Ticket Request System) version 3.0.21 or 3.1.17 or\n3.2.8 or later.\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"summary\", value:\"This host is installed with OTRS (Open Ticket Request System) and is prone to\nsecurity bypass vulnerability.\");\n script_tag(name:\"affected\", value:\"OTRS (Open Ticket Request System) version 3.0.x up to and including 3.0.20,\n3.1.x up to and including 3.1.16 and 3.2.x up to and including 3.2.7.\");\n\n script_xref(name:\"URL\", value:\"http://www.securityfocus.com/bid/60688\");\n script_xref(name:\"URL\", value:\"http://secunia.com/advisories/53851/\");\n script_xref(name:\"URL\", value:\"http://www.otrs.com/en/open-source/community-news/security-advisories/Security-Advisory-2013-04/\");\n script_category(ACT_GATHER_INFO);\n script_family(\"Web application abuses\");\n script_copyright(\"Copyright (C) 2013 Greenbone Networks GmbH\");\n script_dependencies(\"secpod_otrs_detect.nasl\");\n script_require_ports(\"Services/www\", 80);\n script_mandatory_keys(\"OTRS/installed\");\n exit(0);\n}\n\n\ninclude(\"version_func.inc\");\ninclude(\"host_details.inc\");\n\n\nif(!port = get_app_port(cpe:CPE)){\n exit(0);\n}\n\nif(vers = get_app_version(cpe:CPE, port:port))\n{\n if(version_in_range(version:vers, test_version:\"3.2.0\", test_version2:\"3.2.7\") ||\n version_in_range(version:vers, test_version:\"3.0.0\", test_version2:\"3.0.20\") ||\n version_in_range(version:vers, test_version:\"3.1.0\", test_version2:\"3.1.16\"))\n {\n security_message(port:port);\n exit(0);\n }\n\n}\n", "cvss": {"score": 4.0, "vector": "AV:N/AC:L/Au:S/C:P/I:N/A:N"}}, {"lastseen": "2017-07-24T12:52:12", "description": "It was discovered that users with a valid agent login could use\ncrafted URLs to bypass access control restrictions and read tickets to\nwhich they should not have access.\n\nThe oldstable distribution (squeeze) is not affected by this problem.", "cvss3": {}, "published": "2013-06-19T00:00:00", "type": "openvas", "title": "Debian Security Advisory DSA 2712-1 (otrs2 - privilege escalation)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2013-4088"], "modified": "2017-07-07T00:00:00", "id": "OPENVAS:892712", "href": "http://plugins.openvas.org/nasl.php?oid=892712", "sourceData": "# OpenVAS Vulnerability Test\n# $Id: deb_2712.nasl 6611 2017-07-07 12:07:20Z cfischer $\n# Auto-generated from advisory DSA 2712-1 using nvtgen 1.0\n# Script version: 1.0\n#\n# Author:\n# Greenbone Networks\n#\n# Copyright:\n# Copyright (c) 2013 Greenbone Networks GmbH http://greenbone.net\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\ninclude(\"revisions-lib.inc\");\n\ntag_affected = \"otrs2 on Debian Linux\";\ntag_insight = \"OTRS is an Open source Ticket Request System (also well known as\ntrouble ticket system) with many features to manage customer telephone\ncalls and e-mails. The system is built to allow your support, sales,\npre-sales, billing, internal IT, helpdesk, etc. department to react\nquickly to inbound inquiries. For a detailed documentation see package\notrs-doc-en or otrs-doc-de.\";\ntag_solution = \"For the stable distribution (wheezy), this problem has been fixed in\nversion 3.1.7+dfsg1-8+deb7u2.\n\nFor the unstable distribution (sid), this problem has been fixed in\nversion 3.2.8-1.\n\nWe recommend that you upgrade your otrs2 packages.\";\ntag_summary = \"It was discovered that users with a valid agent login could use\ncrafted URLs to bypass access control restrictions and read tickets to\nwhich they should not have access.\n\nThe oldstable distribution (squeeze) is not affected by this problem.\";\ntag_vuldetect = \"This check tests the installed software version using the apt package manager.\";\n\nif(description)\n{\n script_id(892712);\n script_version(\"$Revision: 6611 $\");\n script_cve_id(\"CVE-2013-4088\");\n script_name(\"Debian Security Advisory DSA 2712-1 (otrs2 - privilege escalation)\");\n script_tag(name: \"last_modification\", value:\"$Date: 2017-07-07 14:07:20 +0200 (Fri, 07 Jul 2017) $\");\n script_tag(name: \"creation_date\", value:\"2013-06-19 00:00:00 +0200 (Wed, 19 Jun 2013)\");\n script_tag(name: \"cvss_base\", value:\"10.0\");\n script_tag(name: \"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n\n script_xref(name: \"URL\", value: \"http://www.debian.org/security/2013/dsa-2712.html\");\n\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2013 Greenbone Networks GmbH http://greenbone.net\");\n script_family(\"Debian Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/debian_linux\", \"ssh/login/packages\");\n script_tag(name: \"affected\", value: tag_affected);\n script_tag(name: \"insight\", value: tag_insight);\n# script_tag(name: \"impact\", value: tag_impact);\n script_tag(name: \"solution\", value: tag_solution);\n script_tag(name: \"summary\", value: tag_summary);\n script_tag(name: \"vuldetect\", value: tag_vuldetect);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n\n exit(0);\n}\n\ninclude(\"pkg-lib-deb.inc\");\n\nres = \"\";\nreport = \"\";\nif ((res = isdpkgvuln(pkg:\"otrs\", ver:\"3.1.7+dfsg1-8+deb7u2\", rls:\"DEB7.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"otrs2\", ver:\"3.1.7+dfsg1-8+deb7u2\", rls:\"DEB7.0\")) != NULL) {\n report += res;\n}\n\nif (report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99); # Not vulnerable.\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2020-03-03T20:58:42", "description": "A vulnerability has been discovered in the Open Ticket Request System,\nwhich can be exploited by malicious users to disclose potentially\nsensitive information.\n\nAn attacker with a valid agent login could manipulate URLs in the ticket\nsplit mechanism to see contents of tickets they are not permitted to\nsee.\n\nThe oldstable distribution (squeeze) is not affected by this issue.", "cvss3": {}, "published": "2013-05-29T00:00:00", "type": "openvas", "title": "Debian Security Advisory DSA 2696-1 (otrs2 - privilege escalation)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2013-3551"], "modified": "2020-03-02T00:00:00", "id": "OPENVAS:1361412562310892696", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310892696", "sourceData": "# OpenVAS Vulnerability Test\n# Auto-generated from advisory DSA 2696-1 using nvtgen 1.0\n# Script version: 1.0\n#\n# Author:\n# Greenbone Networks\n#\n# Copyright:\n# Copyright (C) 2013 Greenbone Networks GmbH http://greenbone.net\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.892696\");\n script_version(\"2020-03-02T07:51:06+0000\");\n script_cve_id(\"CVE-2013-3551\");\n script_name(\"Debian Security Advisory DSA 2696-1 (otrs2 - privilege escalation)\");\n script_tag(name:\"last_modification\", value:\"2020-03-02 07:51:06 +0000 (Mon, 02 Mar 2020)\");\n script_tag(name:\"creation_date\", value:\"2013-05-29 00:00:00 +0200 (Wed, 29 May 2013)\");\n script_tag(name:\"cvss_base\", value:\"4.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:S/C:P/I:N/A:N\");\n\n script_xref(name:\"URL\", value:\"http://www.debian.org/security/2013/dsa-2696.html\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2013 Greenbone Networks GmbH http://greenbone.net\");\n script_family(\"Debian Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/debian_linux\", \"ssh/login/packages\", re:\"ssh/login/release=DEB7\");\n script_tag(name:\"affected\", value:\"otrs2 on Debian Linux\");\n script_tag(name:\"solution\", value:\"For the stable distribution (wheezy), this problem has been fixed in\nversion 3.1.7+dfsg1-8+deb7u1.\n\nFor the testing distribution (jessie), this problem has been fixed in\nversion 3.2.7-1.\n\nFor the unstable distribution (sid), this problem has been fixed in\nversion 3.2.7-1.\n\nWe recommend that you upgrade your otrs2 packages.\");\n script_tag(name:\"summary\", value:\"A vulnerability has been discovered in the Open Ticket Request System,\nwhich can be exploited by malicious users to disclose potentially\nsensitive information.\n\nAn attacker with a valid agent login could manipulate URLs in the ticket\nsplit mechanism to see contents of tickets they are not permitted to\nsee.\n\nThe oldstable distribution (squeeze) is not affected by this issue.\");\n script_tag(name:\"vuldetect\", value:\"This check tests the installed software version using the apt package manager.\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-deb.inc\");\n\nres = \"\";\nreport = \"\";\nif((res = isdpkgvuln(pkg:\"otrs\", ver:\"3.1.7+dfsg1-8+deb7u1\", rls:\"DEB7\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"otrs2\", ver:\"3.1.7+dfsg1-8+deb7u1\", rls:\"DEB7\")) != NULL) {\n report += res;\n}\n\nif(report != \"\") {\n security_message(data:report);\n} else if(__pkg_match) {\n exit(99);\n}\n", "cvss": {"score": 4.0, "vector": "AV:N/AC:L/Au:S/C:P/I:N/A:N"}}, {"lastseen": "2017-07-24T12:51:55", "description": "A vulnerability has been discovered in the Open Ticket Request System,\nwhich can be exploited by malicious users to disclose potentially\nsensitive information.\n\nAn attacker with a valid agent login could manipulate URLs in the ticket\nsplit mechanism to see contents of tickets they are not permitted to\nsee.\n\nThe oldstable distribution (squeeze) is not affected by this issue.", "cvss3": {}, "published": "2013-05-29T00:00:00", "type": "openvas", "title": "Debian Security Advisory DSA 2696-1 (otrs2 - privilege escalation)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2013-3551"], "modified": "2017-07-07T00:00:00", "id": "OPENVAS:892696", "href": "http://plugins.openvas.org/nasl.php?oid=892696", "sourceData": "# OpenVAS Vulnerability Test\n# $Id: deb_2696.nasl 6611 2017-07-07 12:07:20Z cfischer $\n# Auto-generated from advisory DSA 2696-1 using nvtgen 1.0\n# Script version: 1.0\n#\n# Author:\n# Greenbone Networks\n#\n# Copyright:\n# Copyright (c) 2013 Greenbone Networks GmbH http://greenbone.net\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\ninclude(\"revisions-lib.inc\");\n\ntag_affected = \"otrs2 on Debian Linux\";\ntag_insight = \"OTRS is an Open source Ticket Request System (also well known as\ntrouble ticket system) with many features to manage customer telephone\ncalls and e-mails. The system is built to allow your support, sales,\npre-sales, billing, internal IT, helpdesk, etc. department to react\nquickly to inbound inquiries. For a detailed documentation see package\notrs-doc-en or otrs-doc-de.\";\ntag_solution = \"For the stable distribution (wheezy), this problem has been fixed in\nversion 3.1.7+dfsg1-8+deb7u1.\n\nFor the testing distribution (jessie), this problem has been fixed in\nversion 3.2.7-1.\n\nFor the unstable distribution (sid), this problem has been fixed in\nversion 3.2.7-1.\n\nWe recommend that you upgrade your otrs2 packages.\";\ntag_summary = \"A vulnerability has been discovered in the Open Ticket Request System,\nwhich can be exploited by malicious users to disclose potentially\nsensitive information.\n\nAn attacker with a valid agent login could manipulate URLs in the ticket\nsplit mechanism to see contents of tickets they are not permitted to\nsee.\n\nThe oldstable distribution (squeeze) is not affected by this issue.\";\ntag_vuldetect = \"This check tests the installed software version using the apt package manager.\";\n\nif(description)\n{\n script_id(892696);\n script_version(\"$Revision: 6611 $\");\n script_cve_id(\"CVE-2013-3551\");\n script_name(\"Debian Security Advisory DSA 2696-1 (otrs2 - privilege escalation)\");\n script_tag(name: \"last_modification\", value:\"$Date: 2017-07-07 14:07:20 +0200 (Fri, 07 Jul 2017) $\");\n script_tag(name: \"creation_date\", value:\"2013-05-29 00:00:00 +0200 (Wed, 29 May 2013)\");\n script_tag(name: \"cvss_base\", value:\"10.0\");\n script_tag(name: \"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n\n script_xref(name: \"URL\", value: \"http://www.debian.org/security/2013/dsa-2696.html\");\n\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2013 Greenbone Networks GmbH http://greenbone.net\");\n script_family(\"Debian Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/debian_linux\", \"ssh/login/packages\");\n script_tag(name: \"affected\", value: tag_affected);\n script_tag(name: \"insight\", value: tag_insight);\n# script_tag(name: \"impact\", value: tag_impact);\n script_tag(name: \"solution\", value: tag_solution);\n script_tag(name: \"summary\", value: tag_summary);\n script_tag(name: \"vuldetect\", value: tag_vuldetect);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n\n exit(0);\n}\n\ninclude(\"pkg-lib-deb.inc\");\n\nres = \"\";\nreport = \"\";\nif ((res = isdpkgvuln(pkg:\"otrs\", ver:\"3.1.7+dfsg1-8+deb7u1\", rls:\"DEB7.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"otrs2\", ver:\"3.1.7+dfsg1-8+deb7u1\", rls:\"DEB7.0\")) != NULL) {\n report += res;\n}\n\nif (report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99); # Not vulnerable.\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2020-05-19T17:37:56", "description": "This host is installed with OTRS (Open Ticket Request System) or OTRS:ITSM\n and is prone to information disclosure vulnerability.", "cvss3": {}, "published": "2013-09-27T00:00:00", "type": "openvas", "title": "OTRS ITSM Ticket Split Information Disclosure Vulnerability", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2013-3551"], "modified": "2020-05-15T00:00:00", "id": "OPENVAS:1361412562310803942", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310803942", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# OTRS ITSM Ticket Split Information Disclosure Vulnerability\n#\n# Authors:\n# Shashi Kiran N <nskiran@secpod.com>\n#\n# Copyright:\n# Copyright (C) 2013 Greenbone Networks GmbH\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.803942\");\n script_version(\"2020-05-15T08:09:24+0000\");\n script_cve_id(\"CVE-2013-3551\");\n script_bugtraq_id(60117);\n script_tag(name:\"cvss_base\", value:\"4.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:S/C:P/I:N/A:N\");\n script_tag(name:\"qod_type\", value:\"remote_banner_unreliable\");\n script_tag(name:\"last_modification\", value:\"2020-05-15 08:09:24 +0000 (Fri, 15 May 2020)\");\n script_tag(name:\"creation_date\", value:\"2013-09-27 15:32:31 +0530 (Fri, 27 Sep 2013)\");\n script_name(\"OTRS ITSM Ticket Split Information Disclosure Vulnerability\");\n\n script_tag(name:\"impact\", value:\"Successful exploitation will allow remote attackers to gain access to\n sensitive information.\");\n\n script_tag(name:\"vuldetect\", value:\"Get the installed version and location of OTRS with the help of detect NVT\n and check the OTRS and OTRS:ITSM version is vulnerable or not.\");\n\n script_tag(name:\"insight\", value:\"An error exists in application when handling URLs related to the ticket split\n mechanism.\");\n\n script_tag(name:\"solution\", value:\"Upgrade to OTRS (Open Ticket Request System) version 3.0.20, 3.1.16 and 3.2.7\n or later, and OTRS::ITSM version 3.2.5, 3.1.9 and 3.0.8 or apply the patch from the referenced vendor advisory link.\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n\n script_tag(name:\"summary\", value:\"This host is installed with OTRS (Open Ticket Request System) or OTRS:ITSM\n and is prone to information disclosure vulnerability.\");\n\n script_tag(name:\"affected\", value:\"OTRS (Open Ticket Request System) version 3.0.x up to and including 3.0.19,\n 3.1.x up to and including 3.1.15 and 3.2.x up to and including 3.2.6\n\n OTRS::ITSM 3.1.0 up to and including 3.1.8, 3.0.0 up to and including 3.0.7\n and 3.2.0 up to and including 3.2.4\");\n\n script_xref(name:\"URL\", value:\"http://www.securityfocus.com/bid/60117\");\n script_xref(name:\"URL\", value:\"http://secunia.com/advisories/53496/\");\n script_xref(name:\"URL\", value:\"http://www.otrs.com/en/open-source/community-news/security-advisories/security-advisory-2013-03/\");\n script_category(ACT_GATHER_INFO);\n script_family(\"Web application abuses\");\n script_copyright(\"Copyright (C) 2013 Greenbone Networks GmbH\");\n script_dependencies(\"secpod_otrs_detect.nasl\");\n script_mandatory_keys(\"OTRS/installed\");\n\n exit(0);\n}\n\ninclude(\"http_func.inc\");\ninclude(\"version_func.inc\");\ninclude(\"host_details.inc\");\n\ncpe_list = make_list(\"cpe:/a:otrs:otrs\", \"cpe:/a:otrs:otrs_itsm\");\n\nif(!infos = get_app_version_and_location_from_list(cpe_list:cpe_list, exit_no_version:TRUE))\n exit(0);\n\nvers = infos[\"version\"];\npath = infos[\"location\"];\ncpe = infos[\"cpe\"];\n\nif(\"cpe:/a:otrs:otrs_itsm\" >< cpe) {\n if(version_in_range(version:vers, test_version:\"3.1.0\", test_version2:\"3.1.8\") ||\n version_in_range(version:vers, test_version:\"3.0.0\", test_version2:\"3.0.7\") ||\n version_in_range(version:vers, test_version:\"3.2.0\", test_version2:\"3.2.4\")) {\n report = report_fixed_ver(installed_version:vers, fixed_version:\"See references\", install_path:path);\n security_message(port:0, data:report);\n exit(0);\n }\n}\n\nelse if(\"cpe:/a:otrs:otrs\" >< cpe) {\n if(version_in_range(version:vers, test_version:\"3.2.0\", test_version2:\"3.2.6\") ||\n version_in_range(version:vers, test_version:\"3.0.0\", test_version2:\"3.0.19\") ||\n version_in_range(version:vers, test_version:\"3.1.0\", test_version2:\"3.1.15\")) {\n report = report_fixed_ver(installed_version:vers, fixed_version:\"See references\", install_path:path);\n security_message(port:0, data:report);\n exit(0);\n }\n}\n\nexit(99);\n", "cvss": {"score": 4.0, "vector": "AV:N/AC:L/Au:S/C:P/I:N/A:N"}}, {"lastseen": "2019-12-20T19:58:40", "description": "It was discovered that otrs2, the Open Ticket Request System, does not\nproperly sanitise user-supplied data that is used on SQL queries. An\nattacker with a valid agent login could exploit this issue to craft SQL\nqueries by injecting arbitrary SQL code through manipulated URLs.", "cvss3": {}, "published": "2013-08-02T00:00:00", "type": "openvas", "title": "Debian Security Advisory DSA 2733-1 (otrs2 - SQL injection)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2012-4751", "CVE-2013-4088", "CVE-2013-4717", "CVE-2013-2625"], "modified": "2019-03-18T00:00:00", "id": "OPENVAS:1361412562310892733", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310892733", "sourceData": "# OpenVAS Vulnerability Test\n# $Id: deb_2733.nasl 14276 2019-03-18 14:43:56Z cfischer $\n# Auto-generated from advisory DSA 2733-1 using nvtgen 1.0\n# Script version: 1.0\n#\n# Author:\n# Greenbone Networks\n#\n# Copyright:\n# Copyright (c) 2013 Greenbone Networks GmbH http://greenbone.net\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.892733\");\n script_version(\"$Revision: 14276 $\");\n script_cve_id(\"CVE-2013-2625\", \"CVE-2012-4751\", \"CVE-2013-4088\", \"CVE-2013-4717\");\n script_name(\"Debian Security Advisory DSA 2733-1 (otrs2 - SQL injection)\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-18 15:43:56 +0100 (Mon, 18 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2013-08-02 00:00:00 +0200 (Fri, 02 Aug 2013)\");\n script_tag(name:\"cvss_base\", value:\"10.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n\n script_xref(name:\"URL\", value:\"http://www.debian.org/security/2013/dsa-2733.html\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (c) 2013 Greenbone Networks GmbH http://greenbone.net\");\n script_family(\"Debian Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/debian_linux\", \"ssh/login/packages\", re:\"ssh/login/release=DEB(6|7)\");\n script_tag(name:\"affected\", value:\"otrs2 on Debian Linux\");\n script_tag(name:\"solution\", value:\"For the oldstable distribution (squeeze), this problem has been fixed in\nversion 2.4.9+dfsg1-3+squeeze4. This update also provides fixes for\nCVE-2012-4751, CVE-2013-2625 and CVE-2013-4088\n, which were all fixed for\nstable already.\n\nFor the stable distribution (wheezy), this problem has been fixed in\nversion 3.1.7+dfsg1-8+deb7u3.\n\nFor the testing distribution (jessie), this problem has been fixed in\nversion 3.2.9-1.\n\nFor the unstable distribution (sid), this problem has been fixed in\nversion 3.2.9-1.\n\nWe recommend that you upgrade your otrs2 packages.\");\n script_tag(name:\"summary\", value:\"It was discovered that otrs2, the Open Ticket Request System, does not\nproperly sanitise user-supplied data that is used on SQL queries. An\nattacker with a valid agent login could exploit this issue to craft SQL\nqueries by injecting arbitrary SQL code through manipulated URLs.\");\n script_tag(name:\"vuldetect\", value:\"This check tests the installed software version using the apt package manager.\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-deb.inc\");\n\nres = \"\";\nreport = \"\";\nif((res = isdpkgvuln(pkg:\"otrs2\", ver:\"2.4.9+dfsg1-3+squeeze4\", rls:\"DEB6\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"otrs\", ver:\"3.1.7+dfsg1-8+deb7u3\", rls:\"DEB7\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"otrs2\", ver:\"3.1.7+dfsg1-8+deb7u3\", rls:\"DEB7\")) != NULL) {\n report += res;\n}\n\nif(report != \"\") {\n security_message(data:report);\n} else if(__pkg_match) {\n exit(99);\n}", "cvss": {"score": 6.4, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:N"}}, {"lastseen": "2017-07-24T12:51:35", "description": "It was discovered that otrs2, the Open Ticket Request System, does not\nproperly sanitise user-supplied data that is used on SQL queries. An\nattacker with a valid agent login could exploit this issue to craft SQL\nqueries by injecting arbitrary SQL code through manipulated URLs.", "cvss3": {}, "published": "2013-08-02T00:00:00", "type": "openvas", "title": "Debian Security Advisory DSA 2733-1 (otrs2 - SQL injection)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2012-4751", "CVE-2013-4088", "CVE-2013-4717", "CVE-2013-2625"], "modified": "2017-07-07T00:00:00", "id": "OPENVAS:892733", "href": "http://plugins.openvas.org/nasl.php?oid=892733", "sourceData": "# OpenVAS Vulnerability Test\n# $Id: deb_2733.nasl 6611 2017-07-07 12:07:20Z cfischer $\n# Auto-generated from advisory DSA 2733-1 using nvtgen 1.0\n# Script version: 1.0\n#\n# Author:\n# Greenbone Networks\n#\n# Copyright:\n# Copyright (c) 2013 Greenbone Networks GmbH http://greenbone.net\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\ninclude(\"revisions-lib.inc\");\n\ntag_affected = \"otrs2 on Debian Linux\";\ntag_insight = \"OTRS is an Open source Ticket Request System (also well known as\ntrouble ticket system) with many features to manage customer telephone\ncalls and e-mails. The system is built to allow your support, sales,\npre-sales, billing, internal IT, helpdesk, etc. department to react\nquickly to inbound inquiries. For a detailed documentation see package\notrs-doc-en or otrs-doc-de.\";\ntag_solution = \"For the oldstable distribution (squeeze), this problem has been fixed in\nversion 2.4.9+dfsg1-3+squeeze4. This update also provides fixes for\nCVE-2012-4751, CVE-2013-2625 and CVE-2013-4088 \n, which were all fixed for\nstable already.\n\nFor the stable distribution (wheezy), this problem has been fixed in\nversion 3.1.7+dfsg1-8+deb7u3.\n\nFor the testing distribution (jessie), this problem has been fixed in\nversion 3.2.9-1.\n\nFor the unstable distribution (sid), this problem has been fixed in\nversion 3.2.9-1.\n\nWe recommend that you upgrade your otrs2 packages.\";\ntag_summary = \"It was discovered that otrs2, the Open Ticket Request System, does not\nproperly sanitise user-supplied data that is used on SQL queries. An\nattacker with a valid agent login could exploit this issue to craft SQL\nqueries by injecting arbitrary SQL code through manipulated URLs.\";\ntag_vuldetect = \"This check tests the installed software version using the apt package manager.\";\n\nif(description)\n{\n script_id(892733);\n script_version(\"$Revision: 6611 $\");\n script_cve_id(\"CVE-2013-2625\", \"CVE-2012-4751\", \"CVE-2013-4088\", \"CVE-2013-4717\");\n script_name(\"Debian Security Advisory DSA 2733-1 (otrs2 - SQL injection)\");\n script_tag(name: \"last_modification\", value:\"$Date: 2017-07-07 14:07:20 +0200 (Fri, 07 Jul 2017) $\");\n script_tag(name: \"creation_date\", value:\"2013-08-02 00:00:00 +0200 (Fri, 02 Aug 2013)\");\n script_tag(name: \"cvss_base\", value:\"10.0\");\n script_tag(name: \"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n\n script_xref(name: \"URL\", value: \"http://www.debian.org/security/2013/dsa-2733.html\");\n\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2013 Greenbone Networks GmbH http://greenbone.net\");\n script_family(\"Debian Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/debian_linux\", \"ssh/login/packages\");\n script_tag(name: \"affected\", value: tag_affected);\n script_tag(name: \"insight\", value: tag_insight);\n# script_tag(name: \"impact\", value: tag_impact);\n script_tag(name: \"solution\", value: tag_solution);\n script_tag(name: \"summary\", value: tag_summary);\n script_tag(name: \"vuldetect\", value: tag_vuldetect);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n\n exit(0);\n}\n\ninclude(\"pkg-lib-deb.inc\");\n\nres = \"\";\nreport = \"\";\nif ((res = isdpkgvuln(pkg:\"otrs2\", ver:\"2.4.9+dfsg1-3+squeeze4\", rls:\"DEB6.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"otrs\", ver:\"3.1.7+dfsg1-8+deb7u3\", rls:\"DEB7.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"otrs2\", ver:\"3.1.7+dfsg1-8+deb7u3\", rls:\"DEB7.0\")) != NULL) {\n report += res;\n}\n\nif (report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99); # Not vulnerable.\n}\n", "cvss": {"score": 4.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:NONE/I:PARTIAL/A:NONE/"}}], "ubuntucve": [{"lastseen": "2021-11-22T21:27:17", "description": "Kernel/Modules/AgentTicketWatcher.pm in Open Ticket Request System (OTRS)\n3.0.x before 3.0.21, 3.1.x before 3.1.17, and 3.2.x before 3.2.8 does not\nproperly restrict tickets, which allows remote attackers with a valid agent\nlogin to read restricted tickets via a crafted URL involving the ticket\nsplit mechanism.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 6.5, "privilegesRequired": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "userInteraction": "NONE", "version": "3.1"}, "impactScore": 3.6}, "published": "2020-02-21T00:00:00", "type": "ubuntucve", "title": "CVE-2013-4088", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 4.0, "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "acInsufInfo": false, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2013-4088"], "modified": "2020-02-21T00:00:00", "id": "UB:CVE-2013-4088", "href": "https://ubuntu.com/security/CVE-2013-4088", "cvss": {"score": 4.0, "vector": "AV:N/AC:L/Au:S/C:P/I:N/A:N"}}, {"lastseen": "2021-11-22T21:27:17", "description": "Kernel/Modules/AgentTicketPhone.pm in Open Ticket Request System (OTRS)\n3.0.x before 3.0.20, 3.1.x before 3.1.16, and 3.2.x before 3.2.7, and OTRS\nITSM 3.0.x before 3.0.8, 3.1.x before 3.1.9, and 3.2.x before 3.2.5 does\nnot properly restrict tickets, which allows remote attackers with a valid\nagent login to read restricted tickets via a crafted URL involving the\nticket split mechanism.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 6.5, "privilegesRequired": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "userInteraction": "NONE", "version": "3.1"}, "impactScore": 3.6}, "published": "2020-02-21T00:00:00", "type": "ubuntucve", "title": "CVE-2013-3551", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 4.0, "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "acInsufInfo": false, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2013-3551"], "modified": "2020-02-21T00:00:00", "id": "UB:CVE-2013-3551", "href": "https://ubuntu.com/security/CVE-2013-3551", "cvss": {"score": 4.0, "vector": "AV:N/AC:L/Au:S/C:P/I:N/A:N"}}], "debian": [{"lastseen": "2021-10-21T23:42:24", "description": "- -------------------------------------------------------------------------\nDebian Security Advisory DSA-2712-1 security@debian.org\nhttp://www.debian.org/security/ Florian Weimer\nJune 19, 2013 http://www.debian.org/security/faq\n- -------------------------------------------------------------------------\n\nPackage : otrs2\nVulnerability : privilege escalation\nProblem type : remote\nDebian-specific: no\nCVE ID : CVE-2013-4088\n\nIt was discovered that users with a valid agent login could use\ncrafted URLs to bypass access control restrictions and read tickets to\nwhich they should not have access.\n\nThe oldstable distribution (squeeze) is not affected by this problem.\n\nFor the stable distribution (wheezy), this problem has been fixed in\nversion 3.1.7+dfsg1-8+deb7u2.\n\nFor the unstable distribution (sid), this problem has been fixed in\nversion 3.2.8-1.\n\nWe recommend that you upgrade your otrs2 packages.\n\nFurther information about Debian Security Advisories, how to apply\nthese updates to your system and frequently asked questions can be\nfound at: http://www.debian.org/security/\n\nMailing list: debian-security-announce@lists.debian.org", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 6.5, "privilegesRequired": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "userInteraction": "NONE", "version": "3.1"}, "impactScore": 3.6}, "published": "2013-06-19T21:38:16", "type": "debian", "title": "[SECURITY] [DSA 2712-1] otrs2 security update", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 4.0, "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "acInsufInfo": false, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2013-4088"], "modified": "2013-06-19T21:38:16", "id": "DEBIAN:DSA-2712-1:5E30C", "href": "https://lists.debian.org/debian-security-announce/2013/msg00122.html", "cvss": {"score": 4.0, "vector": "AV:N/AC:L/Au:S/C:P/I:N/A:N"}}, {"lastseen": "2021-11-29T23:28:07", "description": "- -------------------------------------------------------------------------\nDebian Security Advisory DSA-2696-1 security@debian.org\nhttp://www.debian.org/security/ Giuseppe Iuculano\nMay 29, 2013 http://www.debian.org/security/faq\n- -------------------------------------------------------------------------\n\nPackage : otrs2\nVulnerability : privilege escalation\nProblem type : remote\nDebian-specific: no\nCVE ID : CVE-2013-3551\n\nA vulnerability has been discovered in the Open Ticket Request System,\nwhich can be exploited by malicious users to disclose potentially\nsensitive information.\nAn attacker with a valid agent login could manipulate URLs in the ticket\nsplit mechanism to see contents of tickets and they are not permitted to\nsee.\n\nThe oldstable distribution (squeeze), is not affected by this issue.\n\nFor the stable distribution (wheezy), this problem has been fixed in\nversion 3.1.7+dfsg1-8+deb7u1.\n\nFor the testing distribution (jessie), this problem has been fixed in\nversion 3.2.7-1.\n\nFor the unstable distribution (sid), this problem has been fixed in\nversion 3.2.7-1.\n\nWe recommend that you upgrade your otrs2 packages.\n\nFurther information about Debian Security Advisories, how to apply\nthese updates to your system and frequently asked questions can be\nfound at: http://www.debian.org/security/\n\nMailing list: debian-security-announce@lists.debian.org", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 6.5, "privilegesRequired": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "userInteraction": "NONE", "version": "3.1"}, "impactScore": 3.6}, "published": "2013-05-29T14:27:02", "type": "debian", "title": "[SECURITY] [DSA 2696-1] otrs2 security update", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 4.0, "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "acInsufInfo": false, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2013-3551"], "modified": "2013-05-29T14:27:02", "id": "DEBIAN:DSA-2696-1:9E3C7", "href": "https://lists.debian.org/debian-security-announce/2013/msg00105.html", "cvss": {"score": 4.0, "vector": "AV:N/AC:L/Au:S/C:P/I:N/A:N"}}, {"lastseen": "2021-10-21T23:43:04", "description": "- -------------------------------------------------------------------------\nDebian Security Advisory DSA-2696-1 security@debian.org\nhttp://www.debian.org/security/ Giuseppe Iuculano\nMay 29, 2013 http://www.debian.org/security/faq\n- -------------------------------------------------------------------------\n\nPackage : otrs2\nVulnerability : privilege escalation\nProblem type : remote\nDebian-specific: no\nCVE ID : CVE-2013-3551\n\nA vulnerability has been discovered in the Open Ticket Request System,\nwhich can be exploited by malicious users to disclose potentially\nsensitive information.\nAn attacker with a valid agent login could manipulate URLs in the ticket\nsplit mechanism to see contents of tickets and they are not permitted to\nsee.\n\nThe oldstable distribution (squeeze), is not affected by this issue.\n\nFor the stable distribution (wheezy), this problem has been fixed in\nversion 3.1.7+dfsg1-8+deb7u1.\n\nFor the testing distribution (jessie), this problem has been fixed in\nversion 3.2.7-1.\n\nFor the unstable distribution (sid), this problem has been fixed in\nversion 3.2.7-1.\n\nWe recommend that you upgrade your otrs2 packages.\n\nFurther information about Debian Security Advisories, how to apply\nthese updates to your system and frequently asked questions can be\nfound at: http://www.debian.org/security/\n\nMailing list: debian-security-announce@lists.debian.org", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 6.5, "privilegesRequired": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "userInteraction": "NONE", "version": "3.1"}, "impactScore": 3.6}, "published": "2013-05-29T14:27:02", "type": "debian", "title": "[SECURITY] [DSA 2696-1] otrs2 security update", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 4.0, "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "acInsufInfo": false, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2013-3551"], "modified": "2013-05-29T14:27:02", "id": "DEBIAN:DSA-2696-1:FB1E1", "href": "https://lists.debian.org/debian-security-announce/2013/msg00105.html", "cvss": {"score": 4.0, "vector": "AV:N/AC:L/Au:S/C:P/I:N/A:N"}}, {"lastseen": "2021-12-08T00:36:23", "description": "- -------------------------------------------------------------------------\nDebian Security Advisory DSA-2733-1 security@debian.org\nhttp://www.debian.org/security/ Salvatore Bonaccorso\nAugust 02, 2013 http://www.debian.org/security/faq\n- -------------------------------------------------------------------------\n\nPackage : otrs2\nVulnerability : SQL injection\nProblem type : remote\nDebian-specific: no\nCVE ID : CVE-2013-4717\n\nIt was discovered that otrs2, the Open Ticket Request System, does not\nproperly sanitise user-supplied data that is used on SQL queries. An\nattacker with a valid agent login could exploit this issue to craft SQL\nqueries by injecting arbitrary SQL code through manipulated URLs.\n\nFor the oldstable distribution (squeeze), this problem has been fixed in\nversion 2.4.9+dfsg1-3+squeeze4. This update also provides fixes for\nCVE-2012-4751, CVE-2013-2625 and CVE-2013-4088, which were all fixed for\nstable already.\n\nFor the stable distribution (wheezy), this problem has been fixed in\nversion 3.1.7+dfsg1-8+deb7u3.\n\nFor the testing distribution (jessie), this problem has been fixed in\nversion 3.2.9-1.\n\nFor the unstable distribution (sid), this problem has been fixed in\nversion 3.2.9-1.\n\nWe recommend that you upgrade your otrs2 packages.\n\nFurther information about Debian Security Advisories, how to apply\nthese updates to your system and frequently asked questions can be\nfound at: http://www.debian.org/security/\n\nMailing list: debian-security-announce@lists.debian.org", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "baseScore": 8.8, "privilegesRequired": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "userInteraction": "NONE", "version": "3.1"}, "impactScore": 5.9}, "published": "2013-08-02T20:25:45", "type": "debian", "title": "[SECURITY] [DSA 2733-1] otrs2 security update", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.5, "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "acInsufInfo": false, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2012-4751", "CVE-2013-2625", "CVE-2013-4088", "CVE-2013-4717"], "modified": "2013-08-02T20:25:45", "id": "DEBIAN:DSA-2733-1:39C4A", "href": "https://lists.debian.org/debian-security-announce/2013/msg00142.html", "cvss": {"score": 6.5, "vector": "AV:N/AC:L/Au:S/C:P/I:P/A:P"}}, {"lastseen": "2021-11-28T12:22:37", "description": "- -------------------------------------------------------------------------\nDebian Security Advisory DSA-2733-1 security@debian.org\nhttp://www.debian.org/security/ Salvatore Bonaccorso\nAugust 02, 2013 http://www.debian.org/security/faq\n- -------------------------------------------------------------------------\n\nPackage : otrs2\nVulnerability : SQL injection\nProblem type : remote\nDebian-specific: no\nCVE ID : CVE-2013-4717\n\nIt was discovered that otrs2, the Open Ticket Request System, does not\nproperly sanitise user-supplied data that is used on SQL queries. An\nattacker with a valid agent login could exploit this issue to craft SQL\nqueries by injecting arbitrary SQL code through manipulated URLs.\n\nFor the oldstable distribution (squeeze), this problem has been fixed in\nversion 2.4.9+dfsg1-3+squeeze4. This update also provides fixes for\nCVE-2012-4751, CVE-2013-2625 and CVE-2013-4088, which were all fixed for\nstable already.\n\nFor the stable distribution (wheezy), this problem has been fixed in\nversion 3.1.7+dfsg1-8+deb7u3.\n\nFor the testing distribution (jessie), this problem has been fixed in\nversion 3.2.9-1.\n\nFor the unstable distribution (sid), this problem has been fixed in\nversion 3.2.9-1.\n\nWe recommend that you upgrade your otrs2 packages.\n\nFurther information about Debian Security Advisories, how to apply\nthese updates to your system and frequently asked questions can be\nfound at: http://www.debian.org/security/\n\nMailing list: debian-security-announce@lists.debian.org", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "baseScore": 8.8, "privilegesRequired": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "userInteraction": "NONE", "version": "3.1"}, "impactScore": 5.9}, "published": "2013-08-02T20:25:45", "type": "debian", "title": "[SECURITY] [DSA 2733-1] otrs2 security update", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.5, "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "acInsufInfo": false, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2012-4751", "CVE-2013-2625", "CVE-2013-4088", "CVE-2013-4717"], "modified": "2013-08-02T20:25:45", "id": "DEBIAN:DSA-2733-1:B1EAD", "href": "https://lists.debian.org/debian-security-announce/2013/msg00142.html", "cvss": {"score": 6.5, "vector": "AV:N/AC:L/Au:S/C:P/I:P/A:P"}}], "freebsd": [{"lastseen": "2022-01-19T15:51:33", "description": "\n\nThe OTRS Project reports:\n\nAn attacker with a valid agent login could manipulate URLs in the ticket\n\t watch mechanism to see contents of tickets they are not permitted to see.\n\n\n", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 6.5, "privilegesRequired": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "userInteraction": "NONE", "version": "3.1"}, "impactScore": 3.6}, "published": "2013-06-18T00:00:00", "type": "freebsd", "title": "otrs -- information disclosure", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 4.0, "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "acInsufInfo": false, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2013-4088"], "modified": "2013-06-18T00:00:00", "id": "8B97D289-D8CF-11E2-A1F5-60A44C524F57", "href": "https://vuxml.freebsd.org/freebsd/8b97d289-d8cf-11e2-a1f5-60a44c524f57.html", "cvss": {"score": 4.0, "vector": "AV:N/AC:L/Au:S/C:P/I:N/A:N"}}, {"lastseen": "2022-01-19T15:51:33", "description": "\n\nThe OTRS Project reports:\n\nAn attacker with a valid agent login could manipulate URLs in the ticket split mechanism to see contents of tickets and they are not permitted to see.\n\n\n", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 6.5, "privilegesRequired": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "userInteraction": "NONE", "version": "3.1"}, "impactScore": 3.6}, "published": "2013-05-22T00:00:00", "type": "freebsd", "title": "otrs -- information disclosure", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 4.0, "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "acInsufInfo": false, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2013-3551"], "modified": "2013-05-22T00:00:00", "id": "A5B24A6B-C37C-11E2-ADDB-60A44C524F57", "href": "https://vuxml.freebsd.org/freebsd/a5b24a6b-c37c-11e2-addb-60a44c524f57.html", "cvss": {"score": 4.0, "vector": "AV:N/AC:L/Au:S/C:P/I:N/A:N"}}], "cve": [{"lastseen": "2022-03-23T13:23:22", "description": "Kernel/Modules/AgentTicketWatcher.pm in Open Ticket Request System (OTRS) 3.0.x before 3.0.21, 3.1.x before 3.1.17, and 3.2.x before 3.2.8 does not properly restrict tickets, which allows remote attackers with a valid agent login to read restricted tickets via a crafted URL involving the ticket split mechanism.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "baseScore": 6.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 3.6}, "published": "2020-02-21T16:15:00", "type": "cve", "title": "CVE-2013-4088", "cwe": ["CWE-200"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 4.0, "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "impactScore": 2.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2013-4088"], "modified": "2020-02-26T19:33:00", "cpe": [], "id": "CVE-2013-4088", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-4088", "cvss": {"score": 4.0, "vector": "AV:N/AC:L/Au:S/C:P/I:N/A:N"}, "cpe23": []}, {"lastseen": "2022-03-23T13:06:10", "description": "Kernel/Modules/AgentTicketPhone.pm in Open Ticket Request System (OTRS) 3.0.x before 3.0.20, 3.1.x before 3.1.16, and 3.2.x before 3.2.7, and OTRS ITSM 3.0.x before 3.0.8, 3.1.x before 3.1.9, and 3.2.x before 3.2.5 does not properly restrict tickets, which allows remote attackers with a valid agent login to read restricted tickets via a crafted URL involving the ticket split mechanism.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "baseScore": 6.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 3.6}, "published": "2020-02-21T16:15:00", "type": "cve", "title": "CVE-2013-3551", "cwe": ["CWE-200"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 4.0, "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "impactScore": 2.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2013-3551"], "modified": "2020-02-26T19:34:00", "cpe": [], "id": "CVE-2013-3551", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-3551", "cvss": {"score": 4.0, "vector": "AV:N/AC:L/Au:S/C:P/I:N/A:N"}, "cpe23": []}], "debiancve": [{"lastseen": "2022-05-19T19:37:03", "description": "Kernel/Modules/AgentTicketWatcher.pm in Open Ticket Request System (OTRS) 3.0.x before 3.0.21, 3.1.x before 3.1.17, and 3.2.x before 3.2.8 does not properly restrict tickets, which allows remote attackers with a valid agent login to read restricted tickets via a crafted URL involving the ticket split mechanism.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "baseScore": 6.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 3.6}, "published": "2020-02-21T16:15:00", "type": "debiancve", "title": "CVE-2013-4088", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 4.0, "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "impactScore": 2.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2013-4088"], "modified": "2020-02-21T16:15:00", "id": "DEBIANCVE:CVE-2013-4088", "href": "https://security-tracker.debian.org/tracker/CVE-2013-4088", "cvss": {"score": 4.0, "vector": "AV:N/AC:L/Au:S/C:P/I:N/A:N"}}, {"lastseen": "2022-05-19T19:37:03", "description": "Kernel/Modules/AgentTicketPhone.pm in Open Ticket Request System (OTRS) 3.0.x before 3.0.20, 3.1.x before 3.1.16, and 3.2.x before 3.2.7, and OTRS ITSM 3.0.x before 3.0.8, 3.1.x before 3.1.9, and 3.2.x before 3.2.5 does not properly restrict tickets, which allows remote attackers with a valid agent login to read restricted tickets via a crafted URL involving the ticket split mechanism.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "baseScore": 6.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 3.6}, "published": "2020-02-21T16:15:00", "type": "debiancve", "title": "CVE-2013-3551", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 4.0, "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "impactScore": 2.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2013-3551"], "modified": "2020-02-21T16:15:00", "id": "DEBIANCVE:CVE-2013-3551", "href": "https://security-tracker.debian.org/tracker/CVE-2013-3551", "cvss": {"score": 4.0, "vector": "AV:N/AC:L/Au:S/C:P/I:N/A:N"}}]}
