CVE-2019-18179 : An issue was discovered in Open Ticket Request System (OTRS) 7.0.x through 7.0.1

An issue was discovered in Open Ticket Request System (OTRS) 7.0.x through 7.0.12, and Community Edition 5.0.x through 5.0.38 and 6.0.x through 6.0.23. An attacker who is logged into OTRS as an agent is able to list tickets assigned to other agents, even tickets in a queue where the attacker doesn't have permissions.

Published 2020-01-06 20:15:12

Updated 2023-08-31 03:15:10

Source MITRE

View at NVD, CVE.org

Products affected by CVE-2019-18179

Debian » Debian Linux » Version: 8.0
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
Matching versions
Otrs » Otrs
Versions from including (>=) 7.0.0 and up to, including, (<=) 7.0.12
cpe:2.3:a:otrs:otrs:*:*:*:*:*:*:*:*
Matching versions
Otrs » Otrs » Community Edition
Versions from including (>=) 5.0.0 and up to, including, (<=) 5.0.38
cpe:2.3:a:otrs:otrs:*:*:*:*:community:*:*:*
Matching versions
Otrs » Otrs » Community Edition
Versions from including (>=) 6.0.0 and up to, including, (<=) 6.0.23
cpe:2.3:a:otrs:otrs:*:*:*:*:community:*:*:*
Matching versions
Opensuse » Leap » Version: 15.1
cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*
Matching versions
Opensuse » Leap » Version: 15.2
cpe:2.3:o:opensuse:leap:15.2:*:*:*:*:*:*:*
Matching versions
Opensuse » Backports Sle » Version: 15.0
cpe:2.3:a:opensuse:backports_sle:15.0:-:*:*:*:*:*:*
Matching versions
Opensuse » Backports Sle » Version: 15.0 Update SP1
cpe:2.3:a:opensuse:backports_sle:15.0:sp1:*:*:*:*:*:*
Matching versions
Opensuse » Backports Sle » Version: 15.0 Update SP2
cpe:2.3:a:opensuse:backports_sle:15.0:sp2:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2019-18179

EPSS FAQ

0.75%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 71 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2019-18179

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
4.0	MEDIUM	AV:N/AC:L/Au:S/C:P/I:N/A:N	8.0	2.9	NIST
Access Vector: Network Access Complexity: Low Authentication: Single Confidentiality Impact: Partial Integrity Impact: None Availability Impact: None
3.5	LOW	CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N	2.1	1.4	MITRE
Attack Vector: Network Attack Complexity: Low Privileges Required: Low User Interaction: Required Scope: Unchanged Confidentiality: Low Integrity: None Availability: None
4.3	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N	2.8	1.4	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: Low Integrity: None Availability: None

References for CVE-2019-18179

https://community.otrs.com/security-advisory-2019-14-security-update-for-otrs-framework/

Security Advisory 2019-14: Security Update for OTRS Framework - ((OTRS)) Community Edition
Patch;Vendor Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00038.html

[security-announce] openSUSE-SU-2020:0551-1: moderate: Recommended updat
Mailing List;Third Party Advisory

CVEs referencing this url
http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00066.html

[security-announce] openSUSE-SU-2020:1475-1: moderate: Recommended updat
Mailing List;Third Party Advisory

CVEs referencing this url
https://lists.debian.org/debian-lts-announce/2020/01/msg00000.html

[SECURITY] [DLA 2053-1] otrs2 security update
Mailing List;Third Party Advisory
https://lists.debian.org/debian-lts-announce/2023/08/msg00040.html

[SECURITY] [DLA 3551-1] otrs2 security update

CVEs referencing this url
http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00077.html

[security-announce] openSUSE-SU-2020:1509-1: moderate: Recommended updat
Mailing List;Third Party Advisory

CVEs referencing this url

Jump to

Vulnerability Details : CVE-2019-18179

Products affected by CVE-2019-18179

Exploit prediction scoring system (EPSS) score for CVE-2019-18179

CVSS scores for CVE-2019-18179

References for CVE-2019-18179