CVE-2023-38058: otrs ag otrs Improper Privilege Management
CVSS: 4.3v3.1MediumModified
AliasesUBUNTU-CVE-2023-38058
Published 24-07-2023Last modified 17-10-2024
Vulnerability summary
CVE-2023-38058 is a medium (CVSS 4.3) Improper Privilege Management vulnerability in otrs ag otrs. EPSS estimates a 0.38% chance of exploitation in the next 30 days, higher than 30.3% of scored vulnerabilities.
CVSS score
4.3/10
010
Medium · v3.1 (NVD)EPSS score
0.38%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Timeline
- 24-07-2023PublishedVulnerability first disclosed.
- 17-10-2024Last modifiedVulnerability information updated.
Description
An improper privilege check in the OTRS ticket move action in the agent interface allows any as agent authenticated attacker to to perform a move of an ticket without the needed permission. This issue affects OTRS: from 8.0.X before 8.0.35.
CVSS metrics
3 scores · 3 sources · 1 versionMedium 4.3Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:NSources3 sources · 4.1–4.3
- CVE.orgCNA4.1MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:NDiffers
- OSV · UbuntuEcosystem advisory · calculated4.3MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
EPSS trend
Probability
0.38%
Chance of exploitation in the next 30 days
Percentile
30%
Versus all other CVEs
30-day change
0.00 pp
From 0.38% on 22-09-2026
22-09-202622-10-2026
EPSS score0.38%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-269Improper Privilege ManagementThe product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
- CWE-863Incorrect AuthorizationThe product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
Affected systems
Ubuntu2 products
- otrs2All versions (No fix recorded)
- znunyAll versions (No fix recorded)
Otrs1 product
- otrs≥ 8.0.0, < 8.0.35
Otrs ag1 product
- otrs≥ 8.0.x, < 8.0.35
3 vendors · 4 products