CVE-2008-7282

Kernel/Output/HTML/CustomerNewTicketQueueSelectionGeneric.pm in Open Ticket Request System (OTRS) before 2.2.6, when the CustomerPanelOwnSelection and CustomerGroupSupport options are enabled, allows remote authenticated users to bypass intended access restrictions, and perform certain (1) list and (2) write operations on queues, via unspecified vectors.

Published Bycve@mitre.org

Published DateMar 18, 2011, 16:55

Weakness Type (CWE):CWE-264

CVSS Metrics

Base Score

4.6

Vector String

AV:N/AC:H/Au:S/C:P/I:P/A:P

Base Severity

Version

2.0

Attack Vector (AV)

Attack Complexity (AC)

Privileges Required (PR)

User Interaction (UI)

Scope (S)

Confidentiality (C)

PARTIAL

Integrity (I)

PARTIAL

Availability (A)

PARTIAL

References

http://bugs.otrs.org/show_bug.cgi?id=2696
http://source.otrs.org/viewvc.cgi/otrs/CHANGES?revision=1.1807

Weakness Type (CWE):CWE-264

CVSS Metrics

Base Score

4.6

Vector String

AV:N/AC:H/Au:S/C:P/I:P/A:P

Base Severity

Version

2.0

Attack Vector (AV)

Attack Complexity (AC)

Privileges Required (PR)

User Interaction (UI)

Scope (S)

Confidentiality (C)

PARTIAL

Integrity (I)

PARTIAL

Availability (A)

PARTIAL