Vulnerability Details : CVE-2019-12746
An issue was discovered in Open Ticket Request System (OTRS) Community Edition 5.0.x through 5.0.36 and 6.0.x through 6.0.19. A user logged into OTRS as an agent might unknowingly disclose their session ID by sharing the link of an embedded ticket article with third parties. This identifier can be then be potentially abused in order to impersonate the agent user.
Vulnerability category: Information leak
Products affected by CVE-2019-12746
- cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
- Otrs » Otrs » Community EditionVersions from including (>=) 6.0.0 and up to, including, (<=) 6.0.19cpe:2.3:a:otrs:otrs:*:*:*:*:community:*:*:*
- Otrs » Otrs » Community EditionVersions from including (>=) 5.0.0 and up to, including, (<=) 5.0.36cpe:2.3:a:otrs:otrs:*:*:*:*:community:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2019-12746
0.40%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 73 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2019-12746
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
4.3
|
MEDIUM | AV:N/AC:M/Au:N/C:P/I:N/A:N |
8.6
|
2.9
|
NIST | |
|
6.5
|
MEDIUM | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N |
2.8
|
3.6
|
NIST |
CWE ids for CVE-2019-12746
-
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.Assigned by: nvd@nist.gov (Primary)
References for CVE-2019-12746
-
http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00038.html
[security-announce] openSUSE-SU-2020:0551-1: moderate: Recommended updatBroken Link
-
http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00066.html
[security-announce] openSUSE-SU-2020:1475-1: moderate: Recommended updatBroken Link
-
https://www.otrs.com/category/release-and-security-notes-en/
Release and Security Notes Archive | community.otrs.comRelease Notes
-
https://community.otrs.com/security-advisory-2019-10-security-update-for-otrs-framework/
Security Advisory 2019-10: Security Update for OTRS Framework - | community.otrs.comPatch;Vendor Advisory
-
https://lists.debian.org/debian-lts-announce/2019/08/msg00018.html
[SECURITY] [DLA 1877-1] otrs2 security updateMailing List;Third Party Advisory
-
https://lists.debian.org/debian-lts-announce/2023/08/msg00040.html
[SECURITY] [DLA 3551-1] otrs2 security update
-
http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00077.html
[security-announce] openSUSE-SU-2020:1509-1: moderate: Recommended updatBroken Link
Jump to