Vulnerability · Published Jul 15, 2024 · Assigned by OTRS

CVE-2024-23794Agents are able to lock the ticket without the "Owner" permission

Medium 5.2

In plain English

A medium-severity security flaw in OTRS from OTRS AG. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 19% of all known vulnerabilities).

Severity (CVSS 3.1)5.2Medium

Exploit odds (30 days)0.3%top 80.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

An incorrect privilege assignment vulnerability in the inline editing functionality of OTRS can lead to privilege escalation. This flaw allows an agent with read-only permissions to gain full access to a ticket. This issue arises in very rare instances when an admin has previously enabled the setting 'RequiredLock' of 'AgentFrontend::Ticket::InlineEditing::Property###Watch' in the system configuration.This issue affects OTRS: * 8.0.X * 2023.X * from 2024.X through 2024.4.x

Affected products (as reported)

Vendor	Product	Versions
OTRS AG	OTRS	8.0.x2023.x2024.x – through 2024.4.x

Weakness: CWE-266 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:N

References

https://otrs.com/release-notes/otrs-security-advisory-2024-06/