CVE-2024-43446

LowCVSS 3.5/10Last modified Jun 17, 2026

Description

An improper privilege management vulnerability in OTRS Generic Interface module allows change of the Ticket status even if the user only has ro permissions.

This issue affects:

* OTRS 7.0.X

* OTRS 8.0.X * OTRS 2023.X * OTRS 2024.X

* ((OTRS)) Community Edition: 6.0.x

Products based on the ((OTRS)) Community Edition also very likely to be affected

Metrics

CVSS 3.1 3.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-269

Affected software

No affected versions have been published.

Timeline

Published
Jan 27, 2025
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2024

CVE-2024-434478.1Windows SMBv3 Server Remote Code Execution VulnerabilityCVE-2024-434496.8Windows USB Video Class System Driver Elevation of Privilege VulnerabilityCVE-2024-43459.8The Startklar Elementor Addons plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the CVE-2024-434507.5Windows DNS Spoofing VulnerabilityCVE-2024-434516.5NTLM Hash Disclosure Spoofing VulnerabilityCVE-2024-434527.5Windows Registry Elevation of Privilege VulnerabilityCVE-2024-434538.8Windows Routing and Remote Access Service (RRAS) Remote Code Execution VulnerabilityCVE-2024-434547.1Windows Remote Desktop Licensing Service Remote Code Execution VulnerabilityCVE-2024-434559.8Windows Remote Desktop Licensing Service Spoofing VulnerabilityCVE-2024-434567.4Windows Remote Desktop Services Tampering VulnerabilityCVE-2024-434577.8Windows Setup and Deployment Elevation of Privilege VulnerabilityCVE-2024-434587.7Windows Networking Information Disclosure Vulnerability
CVE-2024-43446: Low severity, CVSS 3.5 | Vulnix