CVE-2011-2385

The iPhoneHandle package 0.9.x before 0.9.7 and 1.0.x before 1.0.3 in Open Ticket Request System (OTRS) does not properly restrict use of the iPhoneHandle interface, which allows remote authenticated users to gain privileges, and consequently read or modify OTRS core objects, via unspecified vectors.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
6.5 UNKNOWN
NETWORK
LOW
AV:N/AC:L/Au:S/C:P/I:P/A:P
mitreCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 73%
VendorProductVersion
otrsiphonehandle
0.9.1
otrsiphonehandle
0.9.2
otrsiphonehandle
0.9.3
otrsiphonehandle
0.9.4
otrsiphonehandle
0.9.5
otrsiphonehandle
0.9.6
otrsiphonehandle
1.0.1
otrsiphonehandle
1.0.2
otrsotrs
*
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
otrs2
bullseye/non-free
6.0.32-6
fixed
Common Weakness Enumeration
References
http://osvdb.org/73885
http://otrs.org/advisory/OSA-2011-02-en/
http://secunia.com/advisories/45227
http://www.securityfocus.com/bid/48678
https://exchange.xforce.ibmcloud.com/vulnerabilities/68558
http://osvdb.org/73885
http://otrs.org/advisory/OSA-2011-02-en/
http://secunia.com/advisories/45227
http://www.securityfocus.com/bid/48678
https://exchange.xforce.ibmcloud.com/vulnerabilities/68558