← CVE Intelligence

CVE-2021-36097

Agents are able to lock the ticket without the "Owner" permission PUBLISHED

Description (CNA)

Agents are able to lock the ticket without the "Owner" permission. Once the ticket is locked, it could be moved to the queue where the agent has "rw" permissions and gain a full control. This issue affects: OTRS AG OTRS 8.0.x version: 8.0.16 and prior versions.

Affected (CNA)

Vendor / productVersions
OTRS AG / OTRSaffected 8.0.x through 8.0.16

CWE

CWE-266

References

ADP enrichment

CVE

No English description supplied.