CVE-2019-13457

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

An issue was discovered in Open Ticket Request System (OTRS) 7.0.x through 7.0.8. A customer user can use the search results to disclose information from their "company" tickets (with the same CustomerID), even when the CustomerDisableCompanyTicketAccess setting is turned on.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00038.htmlBroken Link
http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00066.htmlBroken Link
http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00077.htmlBroken Link
https://otrs.com/release-notes/otrs-security-advisory-2019-11/Vendor Advisory
https://www.otrs.com/category/release-and-security-notes-en/Vendor Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00038.htmlBroken Link
http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00066.htmlBroken Link
http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00077.htmlBroken Link
https://otrs.com/release-notes/otrs-security-advisory-2019-11/Vendor Advisory
https://www.otrs.com/category/release-and-security-notes-en/Vendor Advisory

Timeline

Published: Mar 10, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-134586.5An issue was discovered in Open Ticket Request System (OTRS) 7.0.x through 7.0.8, and Community Edition 5.0.x through 5.0.36 and 6.0.x throu CVE-2019-13466.5A denial of service vulnerability exists when Windows improperly handles objects in memory, aka 'Windows Denial of Service Vulnerability'. T CVE-2019-134617.5In PrestaShop before 1.7.6.0 RC2, the id_address_delivery and id_address_invoice parameters are affected by an Insecure Direct Object Refere CVE-2019-134629.1Lansweeper before 7.1.117.4 allows unauthenticated SQL injection.CVE-2019-134636.1An XSS vulnerability in qcopd-shortcode-generator.php in the Simple Link Directory plugin before 7.3.5 for WordPress allows remote attackers CVE-2019-134647.5An issue was discovered in OWASP ModSecurity Core Rule Set (CRS) 3.0.2. Use of X.Filename instead of X_Filename can bypass some PHP Script U CVE-2019-134658.6An issue was discovered in the ROS communications-related packages (aka ros_comm or ros-melodic-ros-comm) through 1.14.3. ROS_ASSERT_MSG onl CVE-2019-134667.5Western Digital SSD Dashboard before 2.5.1.0 and SanDisk SSD Dashboard before 2.5.1.0 have Incorrect Access Control. The “generate reports” CVE-2019-134675.9Description: Western Digital SSD Dashboard before 2.5.1.0 and SanDisk SSD Dashboard before 2.5.1.0 applications are potentially vulnerable t CVE-2019-13476.5A denial of service vulnerability exists when Windows improperly handles objects in memory, aka 'Windows Denial of Service Vulnerability'. T CVE-2019-134709.8MatrixSSL before 4.2.1 has an out-of-bounds read during ASN.1 handling.CVE-2019-134726.1PHPWind 9.1.0 has XSS vulnerabilities in the c and m parameters of the index.php file.