The ACL-customer-status Ticket Type setting in Open Ticket Request System (OTRS) before 3.0.0-beta1 does not restrict the ticket options after an AJAX reload, which allows remote authenticated users to bypass intended ACL restrictions on the (1) Status, (2) Service, and (3) Queue via selections.
References
Configurations
Configuration 1 (hide)
|
History
No history.
Information
Published : 2011-03-18 16:55
Updated : 2011-03-22 04:00
NVD link : CVE-2010-4763
Mitre link : CVE-2010-4763
CVE.ORG link : CVE-2010-4763
JSON object : View
Products Affected
otrs
- otrs
CWE
CWE-264
Permissions, Privileges, and Access Controls