Open Ticket Request System (OTRS) 1.0 Release Candidate 1

The (1) AgentInterface and (2) CustomerInterface components in Open Ticket Request System (OTRS) before 3.0.6 place cleartext credentials into the session data in the database, which makes it easier for context-dependent attackers to obtain sensitive information by reading the _UserLogin and _UserPW fields.

Published: 2011-03-18T16:00:00.000Z
Updated: 2024-08-06T22:28:41.311Z

Open Ticket Request System (OTRS) before 2.3.5 does not properly disable hidden permissions, which allows remote authenticated users to bypass intended queue access restrictions in opportunistic circumstances by visiting a ticket, related to a certain ordering of permission-set and permission-remove operations involving both hidden permissions and other permissions.

Published: 2011-03-18T16:00:00.000Z
Updated: 2024-09-16T23:11:25.717Z

Open Ticket Request System (OTRS) before 2.3.6 does not properly handle e-mail messages in which the From line contains UTF-8 characters associated with diacritical marks and an invalid charset, which allows remote attackers to cause a denial of service (duplicate tickets and duplicate auto-responses) by sending a crafted message to a POP3 mailbox.

Published: 2011-03-18T16:00:00.000Z
Updated: 2024-09-17T02:36:10.578Z

The AgentTicketForward feature in Open Ticket Request System (OTRS) before 2.4.7 does not properly remove inline images from HTML e-mail messages, which allows remote attackers to obtain potentially sensitive image information in opportunistic circumstances by reading a forwarded message in a standard e-mail client.

Published: 2011-03-18T16:00:00.000Z
Updated: 2024-09-16T23:27:10.009Z

Race condition in the Kernel::System::Main::FileWrite method in Open Ticket Request System (OTRS) before 2.4.8 allows remote authenticated users to corrupt the TicketCounter.log data in opportunistic circumstances by creating tickets.

Published: 2011-03-18T16:00:00.000Z
Updated: 2024-09-17T02:15:58.213Z