CVE-2011-2385

https://notcve.org/view.php?id=CVE-2011-2385

The iPhoneHandle package 0.9.x before 0.9.7 and 1.0.x before 1.0.3 in Open Ticket Request System (OTRS) does not properly restrict use of the iPhoneHandle interface, which allows remote authenticated users to gain privileges, and consequently read or modify OTRS core objects, via unspecified vectors. El paquete iPhoneHandle v0.9.x anterior a v0.9.7 y v1.0.x anterios a v1.0.3 en Open Ticket Request System (OTRS) no restringe adecuadamente el uso de intefaces de iPhoneHandle, lo que permite a usuarios autenticados de forma remota obtener privilegios, y en consecuencia, leer o modificar objetos OTRS, a través de vectores desconocidos. • http://osvdb.org/73885 http://otrs.org/advisory/OSA-2011-02-en http://secunia.com/advisories/45227 http://www.securityfocus.com/bid/48678 https://exchange.xforce.ibmcloud.com/vulnerabilities/68558 • CWE-264: Permissions, Privileges, and Access Controls •