CVE-2024-43446

Improper check of permissions in Generic Interface

CVSS 3.5 LOWEPSS 0.2%CWE-269

Vexday Risk Score

8Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 3.5EPSS 0.2%KEV nãoPoC —Nuclei —Metasploit —Patch —

Lifecycle

27 Jan 2025Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

An improper privilege management vulnerability in OTRS Generic Interface module allows change of the Ticket status even if the user only has ro permissions. This issue affects: * OTRS 7.0.X * OTRS 8.0.X * OTRS 2023.X * OTRS 2024.X * ((OTRS)) Community Edition: 6.0.x Products based on the ((OTRS)) Community Edition also very likely to be affected

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

Affected products

OTRS AG · OTRS OTRS AG · ((OTRS)) Community Edition

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://otrs.com/release-notes/otrs-security-advisory-2025-02/