VulnerabilityModified
CVE-2018-19143
Open Ticket Request System (OTRS) 4.0.x before 4.0.33, 5.0.x before 5.0.31, and 6.0.x before 6.0.13 allows an authenticated user to delete files via a modified submission form because upload caching is mishandled.
MEDIUM 6.5EPSS 0.86%
Does this matter?
Lower severity and a low EPSS score (0.86%). Track it; it rarely justifies an emergency change on its own.
Description
Open Ticket Request System (OTRS) 4.0.x before 4.0.33, 5.0.x before 5.0.31, and 6.0.x before 6.0.13 allows an authenticated user to delete files via a modified submission form because upload caching is mishandled.
- CVSS 3.0
- 6.5 MEDIUMCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
- EPSS
- 0.86% probability · 57th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-425
- Affected
- otrs/open ticket request system · debian/debian linux
- Source
- cve@mitre.org
References
- https://community.otrs.com/security-advisory-2018-07-security-update-for-otrs-framework/Patch, Vendor Advisory
- https://lists.debian.org/debian-lts-announce/2018/11/msg00028.htmlMailing List, Third Party Advisory
- https://community.otrs.com/security-advisory-2018-07-security-update-for-otrs-framework/Patch, Vendor Advisory
- https://lists.debian.org/debian-lts-announce/2018/11/msg00028.htmlMailing List, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.