{"id":"CVE-2019-18179","url":"https://www.cyber-defence.io/tools/cve/CVE-2019-18179","generatedAt":"2026-10-28T04:17:13.440Z","title":"An attacker who is logged into OTRS as an agent is able to list tickets assigned to other agents, even tickets in a queue where the attacker doesn't have permissions.","description":"An issue was discovered in Open Ticket Request System (OTRS) 7.0.x through 7.0.12, and Community Edition 5.0.x through 5.0.38 and 6.0.x through 6.0.23. An attacker who is logged into OTRS as an agent is able to list tickets assigned to other agents, even tickets in a queue where the attacker doesn't have permissions.","published":"2020-01-06T20:15:12.000Z","lastModified":"2026-06-17T02:24:25.000Z","status":"Modified","sourceIdentifier":"cve@mitre.org","cvss":{"version":"3.1","score":4.3,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"},"cwe":[],"affected":["otrs/otrs","debian/debian linux","opensuse/backports sle","opensuse/leap"],"epss":{"score":0.01594,"percentile":0.75581,"date":"2026-10-27","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (1.59%). Track it; it rarely justifies an emergency change on its own."},"changes":[],"references":[{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00038.html","tags":["Mailing List","Third Party Advisory"],"source":"cve@mitre.org"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00066.html","tags":["Mailing List","Third Party Advisory"],"source":"cve@mitre.org"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00077.html","tags":["Mailing List","Third Party Advisory"],"source":"cve@mitre.org"},{"url":"https://community.otrs.com/security-advisory-2019-14-security-update-for-otrs-framework/","tags":["Patch","Vendor Advisory"],"source":"cve@mitre.org"},{"url":"https://lists.debian.org/debian-lts-announce/2020/01/msg00000.html","tags":["Mailing List","Third Party Advisory"],"source":"cve@mitre.org"},{"url":"https://lists.debian.org/debian-lts-announce/2023/08/msg00040.html","source":"cve@mitre.org"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00038.html","tags":["Mailing List","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00066.html","tags":["Mailing List","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00077.html","tags":["Mailing List","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://community.otrs.com/security-advisory-2019-14-security-update-for-otrs-framework/","tags":["Patch","Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.debian.org/debian-lts-announce/2020/01/msg00000.html","tags":["Mailing List","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.debian.org/debian-lts-announce/2023/08/msg00040.html","source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2019-18179","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}