CVE-2019-18179

Vulnerability

An authorization bypass issue exists in Open Ticket Request System (OTRS) 7.0.x through 7.0.12, Community Edition 5.0.x through 5.0.38, and 6.0.x through 6.0.23. An agent logged into OTRS can enumerate tickets assigned to other agents, even for queues where the attacker lacks explicit read permissions [1].

Exploitation

The attacker must be authenticated as an OTRS agent. No special privilege or queue access is required beyond standard agent login. The attacker can craft requests or use the interface to list tickets belonging to other agents, bypassing the intended queue-based access controls [1].

Impact

An authenticated attacker gains unauthorized read access to ticket data (including subject, body, and metadata) assigned to other agents, regardless of queue permissions. This leads to information disclosure of potentially sensitive customer or internal data. No write or modification capabilities are indicated [1].

Mitigation

OTRS recommends upgrading to OTRS 7.0.13 or later (for the 7.0.x line), OTRS Community Edition 6.0.24 or later (for 6.0.x), or OTRS Community Edition 5.0.39 or later (for 5.0.x). OTRS 6.x Community Edition is end-of-life and no longer receives security updates; users should migrate to the current supported OTRS version [1].