CVE-2023-38058

low-risk
Published 2023-07-24

An improper privilege check in the OTRS ticket move action in the agent interface allows any as agent authenticated attacker to to perform a move of an ticket without the needed permission. This issue affects OTRS: from 8.0.X before 8.0.35.

Do I need to act?

-
0.15% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
4
CVSS 4.1/10 Medium
NETWORK / LOW complexity

Affected Products (1)

Affected Vendors

Otrs

References (2)

Vendor Advisory https://otrs.com/release-notes/otrs-security-advisory-2023-07/
Vendor Advisory https://otrs.com/release-notes/otrs-security-advisory-2023-07/
24
/ 100
low-risk
Severity 18/34 · Moderate
Exploitability 1/34 · Minimal
Exposure 5/34 · Minimal