Vulnerability Details : CVE-2011-1433
The (1) AgentInterface and (2) CustomerInterface components in Open Ticket Request System (OTRS) before 3.0.6 place cleartext credentials into the session data in the database, which makes it easier for context-dependent attackers to obtain sensitive information by reading the _UserLogin and _UserPW fields.
Products affected by CVE-2011-1433
- cpe:2.3:a:otrs:otrs:*:*:*:*:*:*:*:*
- cpe:2.3:a:otrs:otrs:1.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:otrs:otrs:1.3.2:*:*:*:*:*:*:*
- cpe:2.3:a:otrs:otrs:2.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:otrs:otrs:2.0.3:*:*:*:*:*:*:*
- cpe:2.3:a:otrs:otrs:2.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:otrs:otrs:2.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:otrs:otrs:2.0.4:*:*:*:*:*:*:*
- cpe:2.3:a:otrs:otrs:2.1.0:beta1:*:*:*:*:*:*
- cpe:2.3:a:otrs:otrs:2.1.2:*:*:*:*:*:*:*
- cpe:2.3:a:otrs:otrs:2.1.6:*:*:*:*:*:*:*
- cpe:2.3:a:otrs:otrs:0.5:beta2:*:*:*:*:*:*
- cpe:2.3:a:otrs:otrs:1.1:rc1:*:*:*:*:*:*
- cpe:2.3:a:otrs:otrs:0.5:beta6:*:*:*:*:*:*
- cpe:2.3:a:otrs:otrs:2.0.0:beta1:*:*:*:*:*:*
- cpe:2.3:a:otrs:otrs:2.0.5:*:*:*:*:*:*:*
- cpe:2.3:a:otrs:otrs:1.1.3:*:*:*:*:*:*:*
- cpe:2.3:a:otrs:otrs:1.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:otrs:otrs:1.2.1:*:*:*:*:*:*:*
- cpe:2.3:a:otrs:otrs:1.2.3:*:*:*:*:*:*:*
- cpe:2.3:a:otrs:otrs:2.2.0:beta3:*:*:*:*:*:*
- cpe:2.3:a:otrs:otrs:2.2.0:rc1:*:*:*:*:*:*
- cpe:2.3:a:otrs:otrs:2.2.7:*:*:*:*:*:*:*
- cpe:2.3:a:otrs:otrs:2.2.9:*:*:*:*:*:*:*
- cpe:2.3:a:otrs:otrs:2.2.0:beta1:*:*:*:*:*:*
- cpe:2.3:a:otrs:otrs:0.5:beta7:*:*:*:*:*:*
- cpe:2.3:a:otrs:otrs:0.5:beta8:*:*:*:*:*:*
- cpe:2.3:a:otrs:otrs:1.1.1:*:*:*:*:*:*:*
- cpe:2.3:a:otrs:otrs:1.3.3:*:*:*:*:*:*:*
- cpe:2.3:a:otrs:otrs:1.1.0:rc1:*:*:*:*:*:*
- cpe:2.3:a:otrs:otrs:1.1.0:rc2:*:*:*:*:*:*
- cpe:2.3:a:otrs:otrs:1.1.2:*:*:*:*:*:*:*
- cpe:2.3:a:otrs:otrs:1.2.0:beta1:*:*:*:*:*:*
- cpe:2.3:a:otrs:otrs:1.2.0:beta2:*:*:*:*:*:*
- cpe:2.3:a:otrs:otrs:2.2.2:*:*:*:*:*:*:*
- cpe:2.3:a:otrs:otrs:2.2.3:*:*:*:*:*:*:*
- cpe:2.3:a:otrs:otrs:2.2.4:*:*:*:*:*:*:*
- cpe:2.3:a:otrs:otrs:2.2.5:*:*:*:*:*:*:*
- cpe:2.3:a:otrs:otrs:2.1.1:*:*:*:*:*:*:*
- cpe:2.3:a:otrs:otrs:2.1.8:*:*:*:*:*:*:*
- cpe:2.3:a:otrs:otrs:2.1.4:*:*:*:*:*:*:*
- cpe:2.3:a:otrs:otrs:2.1.3:*:*:*:*:*:*:*
- cpe:2.3:a:otrs:otrs:0.5:beta1:*:*:*:*:*:*
- cpe:2.3:a:otrs:otrs:0.5:beta4:*:*:*:*:*:*
- cpe:2.3:a:otrs:otrs:0.5:beta3:*:*:*:*:*:*
- cpe:2.3:a:otrs:otrs:1.0:rc1:*:*:*:*:*:*
- cpe:2.3:a:otrs:otrs:1.0:rc2:*:*:*:*:*:*
- cpe:2.3:a:otrs:otrs:2.1.7:*:*:*:*:*:*:*
- cpe:2.3:a:otrs:otrs:2.0.0:beta2:*:*:*:*:*:*
- cpe:2.3:a:otrs:otrs:2.0.0:beta6:*:*:*:*:*:*
- cpe:2.3:a:otrs:otrs:2.0.0:beta5:*:*:*:*:*:*
- cpe:2.3:a:otrs:otrs:1.3.0:beta1:*:*:*:*:*:*
- cpe:2.3:a:otrs:otrs:1.3.0:beta2:*:*:*:*:*:*
- cpe:2.3:a:otrs:otrs:1.3.0:beta3:*:*:*:*:*:*
- cpe:2.3:a:otrs:otrs:1.3.0:beta4:*:*:*:*:*:*
- cpe:2.3:a:otrs:otrs:2.3.0:beta1:*:*:*:*:*:*
- cpe:2.3:a:otrs:otrs:2.3.0:beta2:*:*:*:*:*:*
- cpe:2.3:a:otrs:otrs:2.3.0:beta3:*:*:*:*:*:*
- cpe:2.3:a:otrs:otrs:2.3.0:beta4:*:*:*:*:*:*
- cpe:2.3:a:otrs:otrs:2.3.0:rc1:*:*:*:*:*:*
- cpe:2.3:a:otrs:otrs:2.1.0:beta2:*:*:*:*:*:*
- cpe:2.3:a:otrs:otrs:2.1.9:*:*:*:*:*:*:*
- cpe:2.3:a:otrs:otrs:2.1.5:*:*:*:*:*:*:*
- cpe:2.3:a:otrs:otrs:2.2.0:beta2:*:*:*:*:*:*
- cpe:2.3:a:otrs:otrs:1.0:rc3:*:*:*:*:*:*
- cpe:2.3:a:otrs:otrs:0.5:beta5:*:*:*:*:*:*
- cpe:2.3:a:otrs:otrs:1.3.1:*:*:*:*:*:*:*
- cpe:2.3:a:otrs:otrs:2.0.0:beta4:*:*:*:*:*:*
- cpe:2.3:a:otrs:otrs:1.2.4:*:*:*:*:*:*:*
- cpe:2.3:a:otrs:otrs:1.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:otrs:otrs:1.2.0:beta3:*:*:*:*:*:*
- cpe:2.3:a:otrs:otrs:1.2.2:*:*:*:*:*:*:*
- cpe:2.3:a:otrs:otrs:2.2.0:beta4:*:*:*:*:*:*
- cpe:2.3:a:otrs:otrs:2.2.1:*:*:*:*:*:*:*
- cpe:2.3:a:otrs:otrs:2.2.6:*:*:*:*:*:*:*
- cpe:2.3:a:otrs:otrs:2.2.8:*:*:*:*:*:*:*
- cpe:2.3:a:otrs:otrs:2.3.1:*:*:*:*:*:*:*
- cpe:2.3:a:otrs:otrs:1.1.4:*:*:*:*:*:*:*
- cpe:2.3:a:otrs:otrs:2.3.2:*:*:*:*:*:*:*
- cpe:2.3:a:otrs:otrs:2.3.5:*:*:*:*:*:*:*
- cpe:2.3:a:otrs:otrs:2.4.0:beta2:*:*:*:*:*:*
- cpe:2.3:a:otrs:otrs:2.4.0:beta6:*:*:*:*:*:*
- cpe:2.3:a:otrs:otrs:2.4.0:beta4:*:*:*:*:*:*
- cpe:2.3:a:otrs:otrs:2.4.0:beta5:*:*:*:*:*:*
- cpe:2.3:a:otrs:otrs:2.4.1:*:*:*:*:*:*:*
- cpe:2.3:a:otrs:otrs:2.4.2:*:*:*:*:*:*:*
- cpe:2.3:a:otrs:otrs:2.3.3:*:*:*:*:*:*:*
- cpe:2.3:a:otrs:otrs:2.3.4:*:*:*:*:*:*:*
- cpe:2.3:a:otrs:otrs:2.3.6:*:*:*:*:*:*:*
- cpe:2.3:a:otrs:otrs:2.4.0:beta3:*:*:*:*:*:*
- cpe:2.3:a:otrs:otrs:2.4.0:beta1:*:*:*:*:*:*
- cpe:2.3:a:otrs:otrs:2.4.3:*:*:*:*:*:*:*
- cpe:2.3:a:otrs:otrs:2.4.6:*:*:*:*:*:*:*
- cpe:2.3:a:otrs:otrs:2.4.5:*:*:*:*:*:*:*
- cpe:2.3:a:otrs:otrs:2.4.4:*:*:*:*:*:*:*
- cpe:2.3:a:otrs:otrs:2.4.7:*:*:*:*:*:*:*
- cpe:2.3:a:otrs:otrs:2.4.9:*:*:*:*:*:*:*
- cpe:2.3:a:otrs:otrs:3.0.0:beta7:*:*:*:*:*:*
- cpe:2.3:a:otrs:otrs:3.0.0:beta6:*:*:*:*:*:*
- cpe:2.3:a:otrs:otrs:3.0.0:beta1:*:*:*:*:*:*
- cpe:2.3:a:otrs:otrs:3.0.0:beta2:*:*:*:*:*:*
- cpe:2.3:a:otrs:otrs:3.0.0:beta3:*:*:*:*:*:*
- cpe:2.3:a:otrs:otrs:3.0.0:beta4:*:*:*:*:*:*
- cpe:2.3:a:otrs:otrs:2.4.8:*:*:*:*:*:*:*
- cpe:2.3:a:otrs:otrs:2.4.10:*:*:*:*:*:*:*
- cpe:2.3:a:otrs:otrs:3.0.0:beta5:*:*:*:*:*:*
- cpe:2.3:a:otrs:otrs:3.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:otrs:otrs:3.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:otrs:otrs:3.0.3:*:*:*:*:*:*:*
- cpe:2.3:a:otrs:otrs:3.0.4:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2011-1433
0.13%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 47 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2011-1433
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
5.0
|
MEDIUM | AV:N/AC:L/Au:N/C:P/I:N/A:N |
10.0
|
2.9
|
NIST |
CWE ids for CVE-2011-1433
-
Assigned by: nvd@nist.gov (Primary)
References for CVE-2011-1433
-
https://exchange.xforce.ibmcloud.com/vulnerabilities/66196
Open Ticket Request System AgentInterface information disclosure CVE-2011-1433 Vulnerability Report
-
http://bugs.otrs.org/show_bug.cgi?id=6878
6878 – Agent and customer usernames and passwords stored plaintext in database and sessionPatch
-
http://source.otrs.org/viewvc.cgi/otrs/CHANGES?revision=1.1807
404 Not Found
Jump to