VulnerabilityDeferred

CVE-2024-43446

An improper privilege management vulnerability in OTRS Generic Interface module allows change of the Ticket status even if the user only has ro permissions.

LOW 3.5EPSS 0.22%

Does this matter?

Lower severity and a low EPSS score (0.22%). Track it; it rarely justifies an emergency change on its own.

Description

An improper privilege management vulnerability in OTRS Generic Interface module allows change of the Ticket status even if the user only has ro permissions. This issue affects: * OTRS 7.0.X * OTRS 8.0.X * OTRS 2023.X * OTRS 2024.X * ((OTRS)) Community Edition: 6.0.x Products based on the ((OTRS)) Community Edition also very likely to be affected

CVSS 3.1: 3.5 LOWCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
EPSS: 0.22% probability · 12th percentile
CISA KEV: Not listed
Weakness: CWE-269
Source: security@otrs.com

References

https://otrs.com/release-notes/otrs-security-advisory-2025-02/

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.