← Database

CVE-2009-5056

LOW CVSS: 2.1 Published: 2011-03-18 Modified: 2026-06-16

Description

Open Ticket Request System (OTRS) before 2.4.0-beta2 does not properly enforce the move_into permission setting for a queue, which allows remote authenticated users to bypass intended access restrictions and read a ticket by watching this ticket, and then selecting the ticket from the watched-tickets list.

Affected Platforms

Otrs Otrs

Weakness Type

CWE-20

References