Candidate: CVE-2013-4088
PublicDate: 2020-02-21 16:15:00 UTC
References:
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4088
 http://www.otrs.com/en/open-source/community-news/security-advisories/security-advisory-2013-04/
Description:
 Kernel/Modules/AgentTicketWatcher.pm in Open Ticket Request System (OTRS)
 3.0.x before 3.0.21, 3.1.x before 3.1.17, and 3.2.x before 3.2.8 does not
 properly restrict tickets, which allows remote attackers with a valid agent
 login to read restricted tickets via a crafted URL involving the ticket
 split mechanism.
Ubuntu-Description:
Notes:
Bugs:
Priority: low
Discovered-by:
Assigned-to:
CVSS:
 nvd: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N [6.5 MEDIUM]

Patches_otrs2:
 vendor: http://www.debian.org/security/2013/dsa-2711
upstream_otrs2: released (3.2.8)
lucid_otrs2: ignored (reached end-of-life)
precise_otrs2: ignored (reached end-of-life)
precise/esm_otrs2: DNE (precise was needed)
quantal_otrs2: ignored (reached end-of-life)
raring_otrs2: ignored (reached end-of-life)
saucy_otrs2: not-affected (3.2.9-2)
trusty_otrs2: not-affected (3.3.5-1)
trusty/esm_otrs2: DNE (trusty was not-affected [3.3.5-1])
utopic_otrs2: not-affected (3.3.5-1)
vivid_otrs2: not-affected (3.3.5-1)
vivid/stable-phone-overlay_otrs2: DNE
vivid/ubuntu-core_otrs2: DNE
wily_otrs2: not-affected (3.3.5-1)
xenial_otrs2: not-affected (3.3.5-1)
yakkety_otrs2: not-affected (3.3.5-1)
zesty_otrs2: not-affected (3.3.5-1)
devel_otrs2: not-affected (3.3.5-1)