Fluid Attacks Database

Description

Open Ticket Request System (OTRS) before 2.4.4 grants ticket access on the basis of single-digit substrings of the CustomerID value, which allows remote authenticated users to bypass intended access restrictions in opportunistic circumstances by visiting a ticket, as demonstrated by leveraging the CustomerID 12 account to read tickets that should be available only to CustomerID 1 or CustomerID 2.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Package	Affected version	Patched versions
debian 11	otrs2	=2.0.4p01-10 \|\| =2.0.4p01-11 \|\| =2.0.4p01-12 \|\| =2.0.4p01-13 \|\| =2.0.4p01-14 \|\| =2.0.4p01-14.1 \|\| =2.0.4p01-15 \|\| =2.0.4p01-16 \|\| =2.0.4p01-17 \|\| =2.0.4p01-18 \|\| =2.0.4p01-6 \|\| =2.0.4p01-7 \|\| =2.0.4p01-8 \|\| =2.0.4p01-9 \|\| =2.0.99beta1-1 \|\| =2.0.99beta1-2 \|\| =2.1.1-1 \|\| =2.1.3-1 \|\| =2.1.4-1 \|\| =2.1.4-2 \|\| =2.1.5-1 \|\| =2.1.5-2 \|\| =2.1.5-3 \|\| =2.1.6-1 \|\| =2.1.7-1 \|\| =2.1.7-2 \|\| =2.2.0~beta2-1 \|\| =2.2.0~beta3-1 \|\| =2.2.1-1 \|\| =2.2.2-1 \|\| =2.2.3-1 \|\| =2.2.4-1 \|\| =2.2.5-1 \|\| =2.2.5-2 \|\| =2.2.6-1 \|\| =2.2.7-1 \|\| =2.2.7-2 \|\| =2.2.7-2lenny1 \|\| =2.2.7-2lenny2 \|\| =2.2.7-2lenny3 \|\| =2.2.7-3 \|\| =2.3.2-1 \|\| =2.3.2-2 \|\| =2.3.3-1 \|\| =2.3.4-1 \|\| =2.3.4-2 \|\| =2.3.4-3 \|\| =2.3.4-4 \|\| =2.3.4-5 \|\| =2.3.4-6 \|\| =2.3.4-7 \|\| >=0 <2.4.5-1	2.4.5-1

Aliases

1. CVE-2009-50552. NVD-2009-50553. OSV-DEBIAN-2009-50554. OSV-2009-50555. SECURITY-TRACKER-CVE-2009-5055

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.