← CVE Intelligence

CVE-2024-23794

Agents are able to lock the ticket without the "Owner" permission PUBLISHED

Description (CNA)

An incorrect privilege assignment vulnerability in the inline editing functionality of OTRS can lead to privilege escalation. This flaw allows an agent with read-only permissions to gain full access to a ticket. This issue arises in very rare instances when an admin has previously enabled the setting 'RequiredLock' of 'AgentFrontend::Ticket::InlineEditing::Property###Watch' in the system configuration.This issue affects OTRS:  * 8.0.X * 2023.X * from 2024.X through 2024.4.x

Affected (CNA)

Vendor / productVersions
OTRS AG / OTRSaffected 8.0.x; affected 2023.x; affected 2024.x through 2024.4.x

CWE

CWE-266

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.

CVE

No English description supplied.