CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2019-13457
https://notcve.org/view.php?id=CVE-2019-13457
An issue was discovered in Open Ticket Request System (OTRS) 7.0.x through 7.0.8. A customer user can use the search results to disclose information from their "company" tickets (with the same CustomerID), even when the CustomerDisableCompanyTicketAccess setting is turned on. Se detectó un problema en Open Ticket Request System (OTRS) versiones 7.0.x hasta 7.0.8. Un usuario cliente puede usar los resultados de la búsqueda para divulgar información de sus tickets "company" (con el mismo CustomerID), inclusive cuando la configuración CustomerDisableCompanyTicketAccess está activada. • http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00038.html http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00066.html http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00077.html https://otrs.com/release-notes/otrs-security-advisory-2019-11 https://www.otrs.com/category/release-and-security-notes-en • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2019-10065
https://notcve.org/view.php?id=CVE-2019-10065
An issue was discovered in Open Ticket Request System (OTRS) 7.0 through 7.0.6. An attacker who is logged into OTRS as a customer user can use the search result screens to disclose information from internal FAQ articles, a different vulnerability than CVE-2019-9753. Se detectó un problema en Open Ticket Request System (OTRS) versiones 7.0 hasta la versión 7.0.6. Un atacante que está registrado en OTRS como un usuario cliente puede usar unas pantallas de resultados de búsqueda para divulgar información de los artículos internos de las FAQ, una vulnerabilidad diferente de CVE-2019-9753. • https://community.otrs.com/category/release-and-security-notes-en https://otrs.com/release-notes/otrs-security-advisory-2019-07 •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 0CVE-2020-1768 – External Interface does not invalidate session
https://notcve.org/view.php?id=CVE-2020-1768
The external frontend system uses numerous background calls to the backend. Each background request is treated as user activity so the SessionMaxIdleTime will not be reached. This issue affects: OTRS 7.0.x version 7.0.14 and prior versions. El sistema frontend externo usa numerosas llamadas en segundo plano al backend. Cada petición en segundo plano es tratada como actividad del usuario, por lo que la SessionMaxIdleTime no será alcanzada. • https://otrs.com/release-notes/otrs-security-advisory-2020-04 • CWE-613: Insufficient Session Expiration •
CVSS: 4.3EPSS: 0%CPEs: 3EXPL: 0CVE-2020-1767 – Possible to send drafted messages as wrong agent
https://notcve.org/view.php?id=CVE-2020-1767
Agent A is able to save a draft (i.e. for customer reply). Then Agent B can open the draft, change the text completely and send it in the name of Agent A. For the customer it will not be visible that the message was sent by another agent. This issue affects: ((OTRS)) Community Edition 6.0.x version 6.0.24 and prior versions. OTRS 7.0.x version 7.0.13 and prior versions. • https://lists.debian.org/debian-lts-announce/2020/01/msg00027.html https://lists.debian.org/debian-lts-announce/2023/08/msg00040.html https://otrs.com/release-notes/otrs-security-advisory-2020-03 •
CVSS: 6.1EPSS: 1%CPEs: 4EXPL: 0CVE-2020-1766 – Improper handling of uploaded inline images
https://notcve.org/view.php?id=CVE-2020-1766
Due to improper handling of uploaded images it is possible in very unlikely and rare conditions to force the agents browser to execute malicious javascript from a special crafted SVG file rendered as inline jpg file. This issue affects: ((OTRS)) Community Edition 5.0.x version 5.0.39 and prior versions; 6.0.x version 6.0.24 and prior versions. OTRS 7.0.x version 7.0.13 and prior versions. Debido al manejo inapropiado de las imágenes cargadas, es posible, en condiciones muy extrañas y poco frecuentes, forzar al navegador de los agentes a ejecutar JavaScript malicioso desde un archivo SVG especial diseñado tal y como un archivo jpg en línea. Este problema afecta a: ((OTRS)) Community Edition versiones 5.0.x versión 5.0.39 y anteriores; versiones 6.0.x versión 6.0.24 y anteriores. • http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00038.html http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00066.html http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00077.html https://lists.debian.org/debian-lts-announce/2020/01/msg00027.html https://lists.debian.org/debian-lts-announce/2023/08/msg00040.html https://otrs.com/release-notes/otrs-security-advisory-2020-02 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •