CVE-2008-7282

Kernel/Output/HTML/CustomerNewTicketQueueSelectionGeneric.pm in Open Ticket Request System (OTRS) before 2.2.6, when the CustomerPanelOwnSelection and CustomerGroupSupport options are enabled, allows remote authenticated users to bypass intended access restrictions, and perform certain (1) list and (2) write operations on queues, via unspecified vectors.

Link	Resource
http://bugs.otrs.org/show_bug.cgi?id=2696	Patch
http://source.otrs.org/viewvc.cgi/otrs/CHANGES?revision=1.1807

Configuration 1

cpe:2.3:a:otrs:otrs:2.0.0:beta4:*:*:*:*:*:* cpe:2.3:a:otrs:otrs:2.0.0:beta2:*:*:*:*:*:* cpe:2.3:a:otrs:otrs:2.1.3:*:*:*:*:*:*:* cpe:2.3:a:otrs:otrs:2.2.4:*:*:*:*:*:*:* cpe:2.3:a:otrs:otrs:1.0.2:*:*:*:*:*:*:* cpe:2.3:a:otrs:otrs:2.1.8:*:*:*:*:*:*:* cpe:2.3:a:otrs:otrs:1.1.1:*:*:*:*:*:*:* cpe:2.3:a:otrs:otrs:0.5:beta1:*:*:*:*:*:* cpe:2.3:a:otrs:otrs:1.2.0:beta2:*:*:*:*:*:* cpe:2.3:a:otrs:otrs:1.2.0:beta3:*:*:*:*:*:* cpe:2.3:a:otrs:otrs:1.3.1:*:*:*:*:*:*:* cpe:2.3:a:otrs:otrs:2.2.0:beta3:*:*:*:*:*:* cpe:2.3:a:otrs:otrs:2.0.0:beta5:*:*:*:*:*:* cpe:2.3:a:otrs:otrs:2.1.5:*:*:*:*:*:*:* cpe:2.3:a:otrs:otrs:2.1.2:*:*:*:*:*:*:* cpe:2.3:a:otrs:otrs:0.5:beta4:*:*:*:*:*:* cpe:2.3:a:otrs:otrs:0.5:beta7:*:*:*:*:*:* cpe:2.3:a:otrs:otrs:1.3.0:beta4:*:*:*:*:*:* cpe:2.3:a:otrs:otrs:2.2.0:beta4:*:*:*:*:*:* cpe:2.3:a:otrs:otrs:2.0.3:*:*:*:*:*:*:* cpe:2.3:a:otrs:otrs:1.1.0:rc1:*:*:*:*:*:* cpe:2.3:a:otrs:otrs:1.1:rc1:*:*:*:*:*:* cpe:2.3:a:otrs:otrs:0.5:beta2:*:*:*:*:*:* cpe:2.3:a:otrs:otrs:2.1.0:beta1:*:*:*:*:*:* cpe:2.3:a:otrs:otrs:1.2.1:*:*:*:*:*:*:* cpe:2.3:a:otrs:otrs:2.2.0:beta1:*:*:*:*:*:* cpe:2.3:a:otrs:otrs:2.0.0:*:*:*:*:*:*:* cpe:2.3:a:otrs:otrs:1.1.4:*:*:*:*:*:*:* cpe:2.3:a:otrs:otrs:0.5:beta6:*:*:*:*:*:* cpe:2.3:a:otrs:otrs:2.2.0:beta2:*:*:*:*:*:* cpe:2.3:a:otrs:otrs:0.5:beta3:*:*:*:*:*:* cpe:2.3:a:otrs:otrs:1.2.3:*:*:*:*:*:*:* cpe:2.3:a:otrs:otrs:2.2.2:*:*:*:*:*:*:* cpe:2.3:a:otrs:otrs:1.0.1:*:*:*:*:*:*:* cpe:2.3:a:otrs:otrs:1.2.4:*:*:*:*:*:*:* cpe:2.3:a:otrs:otrs:2.0.0:beta1:*:*:*:*:*:* cpe:2.3:a:otrs:otrs:2.0.5:*:*:*:*:*:*:* cpe:2.3:a:otrs:otrs:1.1.2:*:*:*:*:*:*:* cpe:2.3:a:otrs:otrs:2.2.0:rc1:*:*:*:*:*:* cpe:2.3:a:otrs:otrs:0.5:beta8:*:*:*:*:*:* cpe:2.3:a:otrs:otrs:2.1.6:*:*:*:*:*:*:* cpe:2.3:a:otrs:otrs:1.3.2:*:*:*:*:*:*:* cpe:2.3:a:otrs:otrs:2.1.0:beta2:*:*:*:*:*:* cpe:2.3:a:otrs:otrs:1.2.2:*:*:*:*:*:*:* cpe:2.3:a:otrs:otrs:1.0:rc1:*:*:*:*:*:* cpe:2.3:a:otrs:otrs:1.3.0:beta1:*:*:*:*:*:* cpe:2.3:a:otrs:otrs:2.1.7:*:*:*:*:*:*:* cpe:2.3:a:otrs:otrs:2.0.4:*:*:*:*:*:*:* cpe:2.3:a:otrs:otrs:1.3.0:beta3:*:*:*:*:*:* cpe:2.3:a:otrs:otrs:1.3.0:beta2:*:*:*:*:*:* cpe:2.3:a:otrs:otrs:2.1.9:*:*:*:*:*:*:* cpe:2.3:a:otrs:otrs:2.2.1:*:*:*:*:*:*:* cpe:2.3:a:otrs:otrs:1.1.3:*:*:*:*:*:*:* cpe:2.3:a:otrs:otrs:2.1.4:*:*:*:*:*:*:* cpe:2.3:a:otrs:otrs:1.0.0:*:*:*:*:*:*:* cpe:2.3:a:otrs:otrs:2.1.1:*:*:*:*:*:*:* cpe:2.3:a:otrs:otrs:2.0.2:*:*:*:*:*:*:* cpe:2.3:a:otrs:otrs:2.0.1:*:*:*:*:*:*:* cpe:2.3:a:otrs:otrs:*:*:*:*:*:*:*:* cpe:2.3:a:otrs:otrs:1.1.0:rc2:*:*:*:*:*:* cpe:2.3:a:otrs:otrs:2.2.3:*:*:*:*:*:*:* cpe:2.3:a:otrs:otrs:2.0.0:beta6:*:*:*:*:*:* cpe:2.3:a:otrs:otrs:1.3.3:*:*:*:*:*:*:* cpe:2.3:a:otrs:otrs:1.0:rc2:*:*:*:*:*:* cpe:2.3:a:otrs:otrs:1.0:rc3:*:*:*:*:*:* cpe:2.3:a:otrs:otrs:1.2.0:beta1:*:*:*:*:*:* cpe:2.3:a:otrs:otrs:0.5:beta5:*:*:*:*:*:*

---

Published : 2011-03-18 04:55

Updated : 2011-03-22 04:00

---

NVD link : CVE-2008-7282

Mitre link : CVE-2008-7282

Otrs

CWE-264