CVE-2013-2625

MediumCVSS 6.5/10Last modified Jun 16, 2026

Description

An Access Bypass issue exists in OTRS Help Desk before 3.2.4, 3.1.14, and 3.0.19, OTRS ITSM before 3.2.3, 3.1.8, and 3.0.7, and FAQ before 2.2.3, 2.1.4, and 2.0.8. Access rights by the object linking mechanism is not verified

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-269

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://archives.neohapsis.com/archives/bugtraq/2013-08/0009.htmlBroken Link, Third Party Advisory
http://lists.opensuse.org/opensuse-updates/2013-08/msg00027.htmlRelease Notes, Third Party Advisory
http://www.securityfocus.com/bid/58936Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/83287Third Party Advisory, VDB Entry
https://security-tracker.debian.org/tracker/CVE-2013-2625Third Party Advisory
http://archives.neohapsis.com/archives/bugtraq/2013-08/0009.htmlBroken Link, Third Party Advisory
http://lists.opensuse.org/opensuse-updates/2013-08/msg00027.htmlRelease Notes, Third Party Advisory
http://www.securityfocus.com/bid/58936Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/83287Third Party Advisory, VDB Entry
https://security-tracker.debian.org/tracker/CVE-2013-2625Third Party Advisory

Timeline

Published: Nov 27, 2019
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2013

CVE-2013-26277.5SQL injection vulnerability in action.php in Leed (Light Feed), possibly before 1.5 Stable, allows remote attackers to execute arbitrary SQL CVE-2013-26286.8Multiple cross-site request forgery (CSRF) vulnerabilities in action.php in Leed (Light Feed), possibly before 1.5 Stable, allow remote atta CVE-2013-26295.0Leed (Light Feed), possibly before 1.5 Stable, allows remote attackers to bypass authorization via vectors related to the (1) importForm, (2 CVE-2013-26304.3Cross-site scripting (XSS) vulnerability in CA Service Desk Manager 12.5 through 12.7 allows remote attackers to inject arbitrary web script CVE-2013-26315.3TinyWebGallery (TWG) 1.8.9 and earlier contains a full path disclosure vulnerability which allows remote attackers to obtain sensitive infor CVE-2013-26326.8Google V8 before 3.17.13, as used in Google Chrome before 27.0.1444.3, allows remote attackers to cause a denial of service (application cra CVE-2013-26335.0Piwik before 1.11 accepts input from a POST request instead of a GET request in unspecified circumstances, which might allow attackers to ob CVE-2013-26341.9net/dcb/dcbnl.c in the Linux kernel before 3.8.4 does not initialize certain structures, which allows local users to obtain sensitive inform CVE-2013-26351.9The rtnl_fill_ifinfo function in net/core/rtnetlink.c in the Linux kernel before 3.8.4 does not initialize a certain structure member, which CVE-2013-26361.9net/bridge/br_mdb.c in the Linux kernel before 3.8.4 does not initialize certain structures, which allows local users to obtain sensitive in CVE-2013-26376.1A Cross-Site Scripting (XSS) Vulnerability exists in OTRS ITSM prior to 3.2.4, 3.1.8, and 3.0.7 and FAQ prior to 2.1.4 and 2.0.8 via changes CVE-2013-26394.3Cross-site scripting (XSS) vulnerability in CTERA Cloud Storage OS before 3.2.29.0, 3.2.42.0, and earlier allows remote attackers to inject