CVE-2021-36097

Agents are able to lock the ticket without the "Owner" permission. Once the ticket is locked, it could be moved to the queue where the agent has "rw" permissions and gain a full control. This issue affects: OTRS AG OTRS 8.0.x version: 8.0.16 and prior versions.

Score

CVSS 3.1 4.3 Medium

Status

Modified - security@otrs.com

Published

2021-10-18

Last modified

2024-09-16

Weaknesses

CWE-266

Affected products

• Otrs (Otrs)
• Otrs (Otrs Ag)

References

• https://otrs.com/release-notes/otrs-security-advisory-2021-20/