製品・ソフトウェアに関する情報

JVN脆弱性詳細

OTRS の CustomerInterface コンポーネントにおけるアクセス制限を回避される脆弱性

Title	OTRS の CustomerInterface コンポーネントにおけるアクセス制限を回避される脆弱性
Summary	Open Ticket Request System (OTRS) の CustomerInterface コンポーネントは、アクセス制限を回避される、または任意の顧客のチケットアクセスされる脆弱性が存在します。
Possible impacts	リモート認証されたユーザにより、アクセス制限を回避または任意の顧客のチケットアクセスされる可能性があります。
Solution	ベンダ情報および参考情報を参照して適切な対策を実施してください。
Publication Date	March 18, 2011, midnight
Registration Date	March 27, 2012, 6:42 p.m.
Last Update	March 27, 2012, 6:42 p.m.

CVSS2.0 : 警告
Score	6.5
Vector	AV:N/AC:L/Au:S/C:P/I:P/A:P

Affected System

OTRS プロジェクト

OTRS 2.2.8 未満

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2008-7279	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-7279
National Vulnerability Database (NVD)
2	CVE-2008-7279	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2008-7279

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-264	https://jvndb.jvn.jp/ja/cwe/CWE-264.html

ベンダー情報

No	Name	URL
OTRS
1	v 1.1807	http://source.otrs.org/viewvc.cgi/otrs/CHANGES?revision=1.1807

Change Log

No	Changed Details	Date of change
0	[2012年03月27日] 掲載	Feb. 17, 2018, 10:37 a.m.

NVD Vulnerability Information

CVE-2008-7279

Summary	The CustomerInterface component in Open Ticket Request System (OTRS) before 2.2.8 allows remote authenticated users to bypass intended access restrictions and access tickets of arbitrary customers via unspecified vectors.
Publication Date	March 19, 2011, 1:55 a.m.
Registration Date	Jan. 29, 2021, 1:52 p.m.
Last Update	Nov. 21, 2024, 9:58 a.m.

Affected software configurations

Configuration1	or higher	or less	more than	less than
cpe:2.3:a:otrs:otrs:2.0.0:beta4::::::
cpe:2.3:a:otrs:otrs:2.0.0:beta2::::::
cpe:2.3:a:otrs:otrs:2.1.3:::::::*
cpe:2.3:a:otrs:otrs:2.2.4:::::::*
cpe:2.3:a:otrs:otrs:2.2.5:::::::*
cpe:2.3:a:otrs:otrs:1.0.2:::::::*
cpe:2.3:a:otrs:otrs:2.1.8:::::::*
cpe:2.3:a:otrs:otrs:1.1.1:::::::*
cpe:2.3:a:otrs:otrs:0.5:beta1::::::
cpe:2.3:a:otrs:otrs:1.2.0:beta2::::::
cpe:2.3:a:otrs:otrs:1.2.0:beta3::::::
cpe:2.3:a:otrs:otrs:1.3.1:::::::*
cpe:2.3:a:otrs:otrs:2.2.0:beta3::::::
cpe:2.3:a:otrs:otrs:2.0.0:beta5::::::
cpe:2.3:a:otrs:otrs:2.1.5:::::::*
cpe:2.3:a:otrs:otrs:2.1.2:::::::*
cpe:2.3:a:otrs:otrs:0.5:beta4::::::
cpe:2.3:a:otrs:otrs:0.5:beta7::::::
cpe:2.3:a:otrs:otrs:1.3.0:beta4::::::
cpe:2.3:a:otrs:otrs:2.2.0:beta4::::::
cpe:2.3:a:otrs:otrs:2.0.3:::::::*
cpe:2.3:a:otrs:otrs:1.1.0:rc1::::::
cpe:2.3:a:otrs:otrs:1.1:rc1::::::
cpe:2.3:a:otrs:otrs:0.5:beta2::::::
cpe:2.3:a:otrs:otrs:2.1.0:beta1::::::
cpe:2.3:a:otrs:otrs:1.2.1:::::::*
cpe:2.3:a:otrs:otrs:2.2.0:beta1::::::
cpe:2.3:a:otrs:otrs:2.2.6:::::::*
cpe:2.3:a:otrs:otrs:2.0.0:::::::*
cpe:2.3:a:otrs:otrs:1.1.4:::::::*
cpe:2.3:a:otrs:otrs:0.5:beta6::::::
cpe:2.3:a:otrs:otrs:2.2.0:beta2::::::
cpe:2.3:a:otrs:otrs:0.5:beta3::::::
cpe:2.3:a:otrs:otrs:1.2.3:::::::*
cpe:2.3:a:otrs:otrs:2.2.2:::::::*
cpe:2.3:a:otrs:otrs:1.0.1:::::::*
cpe:2.3:a:otrs:otrs:1.2.4:::::::*
cpe:2.3:a:otrs:otrs:2.0.0:beta1::::::
cpe:2.3:a:otrs:otrs:2.0.5:::::::*
cpe:2.3:a:otrs:otrs:1.1.2:::::::*
cpe:2.3:a:otrs:otrs:2.2.0:rc1::::::
cpe:2.3:a:otrs:otrs:0.5:beta8::::::
cpe:2.3:a:otrs:otrs:2.1.6:::::::*
cpe:2.3:a:otrs:otrs:1.3.2:::::::*
cpe:2.3:a:otrs:otrs:2.1.0:beta2::::::
cpe:2.3:a:otrs:otrs:1.2.2:::::::*
cpe:2.3:a:otrs:otrs:1.0:rc1::::::
cpe:2.3:a:otrs:otrs:1.3.0:beta1::::::
cpe:2.3:a:otrs:otrs:2.1.7:::::::*
cpe:2.3:a:otrs:otrs:2.0.4:::::::*
cpe:2.3:a:otrs:otrs:1.3.0:beta3::::::
cpe:2.3:a:otrs:otrs:1.3.0:beta2::::::
cpe:2.3:a:otrs:otrs:2.1.9:::::::*
cpe:2.3:a:otrs:otrs:2.2.1:::::::*
cpe:2.3:a:otrs:otrs:1.1.3:::::::*
cpe:2.3:a:otrs:otrs:2.1.4:::::::*
cpe:2.3:a:otrs:otrs:1.0.0:::::::*
cpe:2.3:a:otrs:otrs:2.1.1:::::::*
cpe:2.3:a:otrs:otrs:2.0.2:::::::*
cpe:2.3:a:otrs:otrs:2.0.1:::::::*
cpe:2.3:a:otrs:otrs:1.1.0:rc2::::::
cpe:2.3:a:otrs:otrs:2.2.3:::::::*
cpe:2.3:a:otrs:otrs:2.0.0:beta6::::::
cpe:2.3:a:otrs:otrs:1.3.3:::::::*
cpe:2.3:a:otrs:otrs:1.0:rc2::::::
cpe:2.3:a:otrs:otrs::::::::		2.2.7
cpe:2.3:a:otrs:otrs:1.0:rc3::::::
cpe:2.3:a:otrs:otrs:1.2.0:beta1::::::
cpe:2.3:a:otrs:otrs:0.5:beta5::::::

Related information, measures and tools

No	URL	refsource	タグ
1	http://bugs.otrs.org/show_bug.cgi?id=3103
2	http://bugs.otrs.org/show_bug.cgi?id=3103
3	http://source.otrs.org/viewvc.cgi/otrs/CHANGES?revision=1.1807
4	http://source.otrs.org/viewvc.cgi/otrs/CHANGES?revision=1.1807

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-264	認可・権限・アクセス制御	https://cwe.mitre.org/data/definitions/264.html

Configuration1	or higher	or less	more than	less than
cpe:2.3:a:otrs:otrs:2.0.0:beta4::::::
cpe:2.3:a:otrs:otrs:2.0.0:beta2::::::
cpe:2.3:a:otrs:otrs:2.1.3:::::::*
cpe:2.3:a:otrs:otrs:2.2.4:::::::*
cpe:2.3:a:otrs:otrs:2.2.5:::::::*
cpe:2.3:a:otrs:otrs:1.0.2:::::::*
cpe:2.3:a:otrs:otrs:2.1.8:::::::*
cpe:2.3:a:otrs:otrs:1.1.1:::::::*
cpe:2.3:a:otrs:otrs:0.5:beta1::::::
cpe:2.3:a:otrs:otrs:1.2.0:beta2::::::
cpe:2.3:a:otrs:otrs:1.2.0:beta3::::::
cpe:2.3:a:otrs:otrs:1.3.1:::::::*
cpe:2.3:a:otrs:otrs:2.2.0:beta3::::::
cpe:2.3:a:otrs:otrs:2.0.0:beta5::::::
cpe:2.3:a:otrs:otrs:2.1.5:::::::*
cpe:2.3:a:otrs:otrs:2.1.2:::::::*
cpe:2.3:a:otrs:otrs:0.5:beta4::::::
cpe:2.3:a:otrs:otrs:0.5:beta7::::::
cpe:2.3:a:otrs:otrs:1.3.0:beta4::::::
cpe:2.3:a:otrs:otrs:2.2.0:beta4::::::
cpe:2.3:a:otrs:otrs:2.0.3:::::::*
cpe:2.3:a:otrs:otrs:1.1.0:rc1::::::
cpe:2.3:a:otrs:otrs:1.1:rc1::::::
cpe:2.3:a:otrs:otrs:0.5:beta2::::::
cpe:2.3:a:otrs:otrs:2.1.0:beta1::::::
cpe:2.3:a:otrs:otrs:1.2.1:::::::*
cpe:2.3:a:otrs:otrs:2.2.0:beta1::::::
cpe:2.3:a:otrs:otrs:2.2.6:::::::*
cpe:2.3:a:otrs:otrs:2.0.0:::::::*
cpe:2.3:a:otrs:otrs:1.1.4:::::::*
cpe:2.3:a:otrs:otrs:0.5:beta6::::::
cpe:2.3:a:otrs:otrs:2.2.0:beta2::::::
cpe:2.3:a:otrs:otrs:0.5:beta3::::::
cpe:2.3:a:otrs:otrs:1.2.3:::::::*
cpe:2.3:a:otrs:otrs:2.2.2:::::::*
cpe:2.3:a:otrs:otrs:1.0.1:::::::*
cpe:2.3:a:otrs:otrs:1.2.4:::::::*
cpe:2.3:a:otrs:otrs:2.0.0:beta1::::::
cpe:2.3:a:otrs:otrs:2.0.5:::::::*
cpe:2.3:a:otrs:otrs:1.1.2:::::::*
cpe:2.3:a:otrs:otrs:2.2.0:rc1::::::
cpe:2.3:a:otrs:otrs:0.5:beta8::::::
cpe:2.3:a:otrs:otrs:2.1.6:::::::*
cpe:2.3:a:otrs:otrs:1.3.2:::::::*
cpe:2.3:a:otrs:otrs:2.1.0:beta2::::::
cpe:2.3:a:otrs:otrs:1.2.2:::::::*
cpe:2.3:a:otrs:otrs:1.0:rc1::::::
cpe:2.3:a:otrs:otrs:1.3.0:beta1::::::
cpe:2.3:a:otrs:otrs:2.1.7:::::::*
cpe:2.3:a:otrs:otrs:2.0.4:::::::*
cpe:2.3:a:otrs:otrs:1.3.0:beta3::::::
cpe:2.3:a:otrs:otrs:1.3.0:beta2::::::
cpe:2.3:a:otrs:otrs:2.1.9:::::::*
cpe:2.3:a:otrs:otrs:2.2.1:::::::*
cpe:2.3:a:otrs:otrs:1.1.3:::::::*
cpe:2.3:a:otrs:otrs:2.1.4:::::::*
cpe:2.3:a:otrs:otrs:1.0.0:::::::*
cpe:2.3:a:otrs:otrs:2.1.1:::::::*
cpe:2.3:a:otrs:otrs:2.0.2:::::::*
cpe:2.3:a:otrs:otrs:2.0.1:::::::*
cpe:2.3:a:otrs:otrs:1.1.0:rc2::::::
cpe:2.3:a:otrs:otrs:2.2.3:::::::*
cpe:2.3:a:otrs:otrs:2.0.0:beta6::::::
cpe:2.3:a:otrs:otrs:1.3.3:::::::*
cpe:2.3:a:otrs:otrs:1.0:rc2::::::
cpe:2.3:a:otrs:otrs::::::::		2.2.7
cpe:2.3:a:otrs:otrs:1.0:rc3::::::
cpe:2.3:a:otrs:otrs:1.2.0:beta1::::::
cpe:2.3:a:otrs:otrs:0.5:beta5::::::