Riskcovery

CVE-2024-43446

Improper check of permissions in Generic Interface

State
Published
Severity
3.5 Low
Published
Jan 27, 2025
Updated
Feb 12, 2025
Reserved
Aug 13, 2024

Read the record on cve.org

Description

An improper privilege management vulnerability in OTRS Generic Interface module allows change of the Ticket status even if the user only has ro permissions.

This issue affects:

* OTRS 7.0.X

* OTRS 8.0.X * OTRS 2023.X * OTRS 2024.X

* ((OTRS)) Community Edition: 6.0.x

Products based on the ((OTRS)) Community Edition also very likely to be affected

Scores

CVSSScoreVectorSource
3.13.5 LowCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:NOTRS

Weaknesses

  • CWE-269 Improper Privilege Management

Affected Products

ProductVersions
OTRSOTRS AG
  • 7.0.xAffected
  • 8.0.xAffected
  • 2023.xAffected
  • 2024.xAffected
  • 2025.x to before 2025.1.xAffected
((OTRS)) Community EditionOTRS AG
  • 6.0.x through 6.0.34Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.