CVE-2019-12497

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

An issue was discovered in Open Ticket Request System (OTRS) 7.0.x through 7.0.8, Community Edition 6.0.x through 6.0.19, and Community Edition 5.0.x through 5.0.36. In the customer or external frontend, personal information of agents (e.g., Name and mail address) can be disclosed in external notes.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00038.htmlBroken Link
http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00066.htmlBroken Link
http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00077.htmlBroken Link
https://community.otrs.com/category/security-advisories-en/Vendor Advisory
https://lists.debian.org/debian-lts-announce/2019/06/msg00004.htmlMailing List, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2023/08/msg00040.html
http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00038.htmlBroken Link
http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00066.htmlBroken Link
http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00077.htmlBroken Link
https://community.otrs.com/category/security-advisories-en/Vendor Advisory
https://lists.debian.org/debian-lts-announce/2019/06/msg00004.htmlMailing List, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2023/08/msg00040.html

Timeline

Published: Jun 17, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-124989.8The WP Live Chat Support plugin before 8.0.33 for WordPress accepts certain REST API calls without invoking the wplc_api_permission_check pr CVE-2019-124998.1Firejail before 0.9.60 allows truncation (resizing to length 0) of the firejail binary on the host by running exploit code inside a firejail CVE-2019-12507.8A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database En CVE-2019-125006.5The Xiaomi M365 scooter 2019-02-12 before 1.5.1 allows spoofing of "suddenly accelerate" commands. This occurs because Bluetooth Low Energy CVE-2019-125028.8There is a lack of CSRF countermeasures on MOBOTIX S14 MX-V4.2.1.61 cameras, as demonstrated by adding an admin account via the /admin/acces CVE-2019-125039.8Due to unencrypted and unauthenticated data communication, the wireless barcode scanner Inateck BCST-60 is prone to keystroke injection atta CVE-2019-125048.8Due to unencrypted and unauthenticated data communication, the wireless presenter Inateck WP2002 is prone to keystroke injection attacks. Th CVE-2019-125058.8Due to unencrypted and unauthenticated data communication, the wireless presenter Inateck WP1001 v1.3C is prone to keystroke injection attac CVE-2019-125068.8Due to unencrypted and unauthenticated data communication, the wireless presenter Logitech R700 Laser Presentation Remote R-R0010 is prone t CVE-2019-125076.1An XSS vulnerability exists in PHPRelativePath (aka Relative Path) through 1.0.2 via the RelativePath.Example1.php path parameter.CVE-2019-12515.5An information disclosure vulnerability exists when DirectWrite improperly discloses the contents of its memory, aka 'DirectWrite Informatio CVE-2019-125109.1In NETGEAR Nighthawk X10-R900 prior to 1.0.4.26, an attacker may bypass all authentication checks on the device's "NETGEAR Genie" SOAP API (