CVE-2019-13457

Vulnerability

An information disclosure vulnerability exists in Open Ticket Request System (OTRS) 7.0.x up to and including version 7.0.8. A customer user can abuse the search functionality to disclose information from tickets belonging to their "company" (sharing the same CustomerID), even when the administrator has explicitly disabled such access by enabling the CustomerDisableCompanyTicketAccess setting [1]. The affected releases are OTRS 7.0.0 through 7.0.8 [1].

Exploitation

An attacker must be an authenticated customer user with a valid account in the OTRS system. No special privileges beyond normal customer access are required. The attacker can perform a search query that returns results containing tickets from other users within the same CustomerID, bypassing the intended restriction imposed by the CustomerDisableCompanyTicketAccess setting. The exact steps are not detailed in the advisory, but the attacker simply uses the standard search interface while the setting is enabled [1].

Impact

A successful attack results in unauthorized information disclosure of ticket data belonging to the same company (same CustomerID). The impact is limited to read access of ticket details, with a CVSS v3 base score of 3.8 (Low) [1]. The confidentiality of ticket information is violated, while integrity and availability are not affected. The attacker does not gain any additional privileges or capabilities beyond reading company tickets [1].

Mitigation

The vulnerability is fixed in OTRS version 7.0.9, released on 2019-07-12 [1]. The advisory recommends upgrading to OTRS 7.0.9 or later. There is no known workaround for systems that cannot immediately upgrade. On-Premise customers can obtain the fixed version from the OTRS portal download area [1].