Lucene search

K
mageiaGentoo FoundationMGASA-2014-0094
HistoryFeb 26, 2014 - 1:22 a.m.

Updated otrs packages fix security vulnerabilities and a missing dependency

2014-02-2601:22:39
Gentoo Foundation
advisories.mageia.org
8

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.006 Low

EPSS

Percentile

78.1%

Updated otrs package fixes security vulnerabilities: In OTRS before 3.2.14, an attacker that managed to take over the session of a logged in customer could create tickets and/or send follow-ups to existing tickets due to missing challenge token checks (CVE-2014-1694). In OTRS before 3.2.14, an attacker with a valid customer or agent login could inject SQL in the ticket search URL (CVE-2014-1471). The update also adds a missing dependency which prevented database creation during web based installation.

OSVersionArchitecturePackageVersionFilename
Mageia3noarchotrs< 3.2.14-1otrs-3.2.14-1.mga3
Mageia4noarchotrs< 3.2.14-1otrs-3.2.14-1.mga4

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.006 Low

EPSS

Percentile

78.1%