low3.5
CVE-2009-5055
Open Ticket Request System (OTRS) before 2.4.4 grants ticket access on the basis of single-digit substrings of the CustomerID value, which allows remote authen…
Impact
Open Ticket Request System (OTRS) before 2.4.4 grants ticket access on the basis of single-digit substrings of the CustomerID value, which allows remote authenticated users to bypass intended access restrictions in opportunistic circumstances by visiting a ticket, as demonstrated by leveraging the CustomerID 12 account to read tickets that should be available only to CustomerID 1 or CustomerID 2.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Otrs | Otrs | through 2.4.3 Versions 0.5, 1.0, 1.0.0, 1.0.1, 1.0.2 |