Unauthorized Access in OTRS2: Bypass of Move_into Permission
Summary
DEBIAN-CVE-2009-5056: Open Ticket Request System (OTRS) before 2.4.0-beta2 does not properly enforce the move_into permission setting for a queue, which allows remote authenticated users to bypass intended access restrictions and read a ticke... Affects otrs2 versions < 2.4.5-1. Fixed in 2.4.5-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Open Ticket Request System (OTRS) is a widely used open-source ticketing system that facilitates efficient management of customer support requests. It allows organizations to track and manage tickets, ensuring timely responses and resolutions. However, prior to version 2.4.0-beta2, OTRS2 had a vulnerability that compromised its permission settings, specifically the move_into permission for queues, which could lead to unauthorized access to sensitive ticket information.
Vulnerability Detail
The vulnerability identified as CVE-2009-5056 in OTRS2 arises from improper enforcement of the move_into permission setting for queues. This flaw allows remote authenticated users to bypass intended access restrictions. By watching a ticket, these users can select it from their watched-tickets list, thereby gaining access to tickets they should not be able to view. This could lead to unauthorized disclosure of sensitive information, impacting the confidentiality of ticket data.
How To Fix
Minimum fixed version
2.4.5-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade otrs2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, administrators can restrict access to the ticketing system by limiting user permissions until the system can be updated to the patched version. This may involve reviewing user roles and ensuring that only authorized personnel have access to sensitive tickets.
Conclusion
The CVE-2009-5056 vulnerability in OTRS2 represents a significant risk due to improper permission enforcement, allowing unauthorized access to ticket information. Updating to the patched version is essential for maintaining the security of the system. Users are encouraged to monitor their installations and take necessary precautions until they can apply the update.
See every vulnerability recorded for otrs2 →
FAQ
CVE-2009-5056 is a vulnerability in OTRS2 that allows authenticated users to bypass access restrictions and view tickets they should not have access to.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The primary risk is unauthorized access to sensitive ticket information, which could lead to data breaches and loss of confidentiality.
Yes, the vulnerability is fixed in OTRS2 version 2.4.5-1 and later. It is crucial to update to this version to mitigate the risk.
If immediate updating is not possible, consider restricting user permissions and reviewing access controls to minimize exposure to the vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for otrs2.
