Design/Logic Flaw

2011-03-1816:55:00

PRIOn knowledge base

www.prio-n.com

6.8 Medium

AI Score

Confidence

Low

0.002 Low

EPSS

Percentile

59.4%

JSON

Open Ticket Request System (OTRS) before 2.3.0-beta4 checks for the rw permission, instead of the configured merge permission, during authorization of merge operations, which might allow remote authenticated users to bypass intended access restrictions by merging two tickets.

CPENameOperatorVersion
otrseq2.0.0 beta4
otrseq2.0.0 beta2
otrseq2.3.0 beta2
otrseq2.1.3
otrseq2.2.4
otrseq2.2.5
otrseq1.0.2
otrseq2.1.8
otrsle2.3.0
otrseq1.1.1