CVE-2019-12746

Vulnerability

An issue was discovered in Open Ticket Request System (OTRS) Community Edition 5.0.x through 5.0.36 and 6.0.x through 6.0.19. The vulnerability arises because a user logged into OTRS as an agent might unknowingly disclose their session ID by sharing the link of an embedded ticket article with third parties [1]. No special configuration is required beyond a standard agent account with the ability to access and share ticket article links.

Exploitation

An attacker does not need any prior authentication or special network position. The exploitation relies on a legitimate agent user sharing a link to a ticket article that embeds the session ID. The agent may do this inadvertently, for example by copying a URL from their browser or email client. Once the third party receives the link, they can extract the session ID and potentially use it to impersonate the agent.

Impact

On successful exploitation, the attacker can impersonate the agent user, gaining the same level of access within the OTRS system. This could lead to unauthorized viewing, modification, or deletion of tickets and customer data, resulting in confidentiality, integrity, and availability compromises. The exact scope depends on the agent's privileges [1].

Mitigation

The OTRS advisory recommends upgrading to the latest supported version. However, note that OTRS Community Edition 6.x is end-of-life and no longer maintained by OTRS, meaning no official security fixes are provided for that branch [1]. Users should migrate to a current supported release to receive security updates and avoid this vulnerability.