Fluid Attacks Database

Description

Kernel/System/Web/Request.pm in Open Ticket Request System (OTRS) before 2.3.2 creates a directory under /tmp/ with 1274 permissions, which might allow local users to bypass intended access restrictions via standard filesystem operations, related to incorrect interpretation of 0700 as a decimal value.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Package	Affected version	Patched versions
debian 11	otrs2	=2.0.4p01-10 \|\| =2.0.4p01-11 \|\| =2.0.4p01-12 \|\| =2.0.4p01-13 \|\| =2.0.4p01-14 \|\| =2.0.4p01-14.1 \|\| =2.0.4p01-15 \|\| =2.0.4p01-16 \|\| =2.0.4p01-17 \|\| =2.0.4p01-18 \|\| =2.0.4p01-6 \|\| =2.0.4p01-7 \|\| =2.0.4p01-8 \|\| =2.0.4p01-9 \|\| =2.0.99beta1-1 \|\| =2.0.99beta1-2 \|\| =2.1.1-1 \|\| =2.1.3-1 \|\| =2.1.4-1 \|\| =2.1.4-2 \|\| =2.1.5-1 \|\| =2.1.5-2 \|\| =2.1.5-3 \|\| =2.1.6-1 \|\| =2.1.7-1 \|\| =2.1.7-2 \|\| =2.2.0~beta2-1 \|\| =2.2.0~beta3-1 \|\| =2.2.1-1 \|\| =2.2.2-1 \|\| =2.2.3-1 \|\| =2.2.4-1 \|\| =2.2.5-1 \|\| =2.2.5-2 \|\| =2.2.6-1 \|\| =2.2.7-1 \|\| =2.2.7-2 \|\| =2.2.7-2lenny1 \|\| =2.2.7-2lenny2 \|\| =2.2.7-2lenny3 \|\| =2.2.7-3 \|\| >=0 <2.3.2-1	2.3.2-1

Aliases

1. CVE-2008-72762. NVD-2008-72763. OSV-DEBIAN-2008-72764. OSV-2008-72765. SECURITY-TRACKER-CVE-2008-7276

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.