Code injection

2021-10-1807:15:00

PRIOn knowledge base

www.prio-n.com

4.8 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

22.9%

JSON

Agents are able to lock the ticket without the “Owner” permission. Once the ticket is locked, it could be moved to the queue where the agent has “rw” permissions and gain a full control. This issue affects: OTRS AG OTRS 8.0.x version: 8.0.16 and prior versions.

CPENameOperatorVersion
otrsge8.0.0
otrsle8.0.16

CPE	Name	Operator	Version
	otrs	ge	8.0.0
	otrs	le	8.0.16

References

otrs.com/release-notes/otrs-security-advisory-2021-20/