CVE-2024-23794

Agents are able to lock the ticket without the "Owner" permission

State: Published
Severity: 5.2 Medium
Published: Jul 15, 2024
Updated: Aug 1, 2024
Reserved: Jan 22, 2024

Description

An incorrect privilege assignment vulnerability in the inline editing functionality of OTRS can lead to privilege escalation. This flaw allows an agent with read-only permissions to gain full access to a ticket. This issue arises in very rare instances when an admin has previously enabled the setting 'RequiredLock' of 'AgentFrontend::Ticket::InlineEditing::Property###Watch' in the system configuration.This issue affects OTRS:

* 8.0.X * 2023.X * from 2024.X through 2024.4.x

Scores

CVSS	Score	Vector	Source
3.1	5.2 Medium	CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:N	OTRS

Weaknesses

CWE-266 Incorrect Privilege Assignment

Affected Products

Product	Versions
OTRSOTRS AG	8.0.xAffected 2023.xAffected 2024.x through 2024.4.xAffected

References

https://otrs.com/release-notes/otrs-security-advisory-2024-06/

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.