VulnerabilityModified
CVE-2019-9753
An attacker who is logged into OTRS as an agent or a customer user can use the search result screens to disclose information from invalid system entities.
MEDIUM 4.3EPSS 0.89%
Does this matter?
Lower severity and a low EPSS score (0.89%). Track it; it rarely justifies an emergency change on its own.
Description
An issue was discovered in Open Ticket Request System (OTRS) 7.x before 7.0.5. An attacker who is logged into OTRS as an agent or a customer user can use the search result screens to disclose information from invalid system entities. Following is the list of affected entities: Custom Pages, FAQ Articles, Service Catalogue Items, ITSM Configuration Items.
- CVSS 3.0
- 4.3 MEDIUMCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- EPSS
- 0.89% probability · 57th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-200
- Affected
- otrs/otrs
- Source
- cve@mitre.org
References
- https://community.otrs.com/security-advisory-2019-03-security-update-for-otrs-frameworkPatch, Vendor Advisory
- https://community.otrs.com/security-advisory-2019-03-security-update-for-otrs-frameworkPatch, Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.