Vulnerability CVE-2014-9324

Vulnerability Name:

CVE-2014-9324 (CCN-99728)

Assigned:

2014-12-16

Published:

2014-12-16

Updated:

2017-01-03

Summary:

The GenericInterface in OTRS Help Desk 3.2.x before 3.2.17, 3.3.x before 3.3.11, and 4.0.x before 4.0.3 allows remote authenticated users to access and modify arbitrary tickets via unspecified vectors.

CVSS v3 Severity:

3.5 Low (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): Low User Interaction (UI): Required
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): None Integrity (I): Low Availibility (A): None

CVSS v2 Severity:

6.0 Medium (CVSS v2 Vector: AV:N/AC:M/Au:S/C:P/I:P/A:P)
4.4 Medium (Temporal CVSS v2 Vector: AV:N/AC:M/Au:S/C:P/I:P/A:P/E:U/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Medium Authentication (Au): Single_Instance
Impact Metrics:	Confidentiality (C): Partial Integrity (I): Partial Availibility (A): Partial

4.0 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:S/C:N/I:P/A:N)
3.0 Low (CCN Temporal CVSS v2 Vector: AV:N/AC:L/Au:S/C:N/I:P/A:N/E:U/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Athentication (Au): Single_Instance
Impact Metrics:	Confidentiality (C): None Integrity (I): Partial Availibility (A): None

Vulnerability Type:

CWE-264

Vulnerability Consequences:

Bypass Security

References:

Source: CONFIRM
Type: UNKNOWN
http://advisories.mageia.org/MGASA-2015-0031.html

Source: MITRE
Type: CNA
CVE-2014-9324

Source: SECUNIA
Type: UNKNOWN
59875

Source: SECUNIA
Type: UNKNOWN
62188

Source: SECUNIA
Type: UNKNOWN
62662

Source: MANDRIVA
Type: UNKNOWN
MDVSA-2015:043

Source: CCN
Type: BID-71989
OTRS Help Desk CVE-2014-9324 Security Bypass Vulnerability

Source: XF
Type: UNKNOWN
otrs-cve20149324-sec-bypass(99728)

Source: CCN
Type: Security Advisory 2014-06
Incomplete Access Control

Source: CONFIRM
Type: Vendor Advisory
https://www.otrs.com/security-advisory-2014-06-incomplete-access-control/

Source: CCN
Type: WhiteSource Vulnerability Database
CVE-2014-9324

Vulnerable Configuration:

Configuration 1:

cpe:/a:otrs:otrs_help_desk:3.2.0:*:*:*:*:*:*:*

OR cpe:/a:otrs:otrs_help_desk:3.2.1:*:*:*:*:*:*:*

OR cpe:/a:otrs:otrs_help_desk:3.2.2:*:*:*:*:*:*:*

OR cpe:/a:otrs:otrs_help_desk:3.2.3:*:*:*:*:*:*:*

OR cpe:/a:otrs:otrs_help_desk:3.2.4:*:*:*:*:*:*:*

OR cpe:/a:otrs:otrs_help_desk:3.2.5:*:*:*:*:*:*:*

OR cpe:/a:otrs:otrs_help_desk:3.2.6:*:*:*:*:*:*:*

OR cpe:/a:otrs:otrs_help_desk:3.2.7:*:*:*:*:*:*:*

OR cpe:/a:otrs:otrs_help_desk:3.2.8:*:*:*:*:*:*:*

OR cpe:/a:otrs:otrs_help_desk:3.2.9:*:*:*:*:*:*:*

OR cpe:/a:otrs:otrs_help_desk:3.2.10:*:*:*:*:*:*:*

OR cpe:/a:otrs:otrs_help_desk:3.2.11:*:*:*:*:*:*:*

OR cpe:/a:otrs:otrs_help_desk:3.2.12:*:*:*:*:*:*:*

OR cpe:/a:otrs:otrs_help_desk:3.2.13:*:*:*:*:*:*:*

OR cpe:/a:otrs:otrs_help_desk:3.2.14:*:*:*:*:*:*:*

OR cpe:/a:otrs:otrs_help_desk:3.2.15:*:*:*:*:*:*:*

OR cpe:/a:otrs:otrs_help_desk:3.2.16:*:*:*:*:*:*:*

OR cpe:/a:otrs:otrs_help_desk:3.3.0:*:*:*:*:*:*:*

OR cpe:/a:otrs:otrs_help_desk:3.3.1:*:*:*:*:*:*:*

OR cpe:/a:otrs:otrs_help_desk:3.3.2:*:*:*:*:*:*:*

OR cpe:/a:otrs:otrs_help_desk:3.3.3:*:*:*:*:*:*:*

OR cpe:/a:otrs:otrs_help_desk:3.3.4:*:*:*:*:*:*:*

OR cpe:/a:otrs:otrs_help_desk:3.3.5:*:*:*:*:*:*:*

OR cpe:/a:otrs:otrs_help_desk:3.3.6:*:*:*:*:*:*:*

OR cpe:/a:otrs:otrs_help_desk:3.3.7:*:*:*:*:*:*:*

OR cpe:/a:otrs:otrs_help_desk:3.3.8:*:*:*:*:*:*:*

OR cpe:/a:otrs:otrs_help_desk:3.3.9:*:*:*:*:*:*:*

OR cpe:/a:otrs:otrs_help_desk:3.3.10:*:*:*:*:*:*:*

OR cpe:/a:otrs:otrs_help_desk:4.0.0:*:*:*:*:*:*:*

OR cpe:/a:otrs:otrs_help_desk:4.0.1:*:*:*:*:*:*:*

OR cpe:/a:otrs:otrs_help_desk:4.0.2:*:*:*:*:*:*:*

Configuration CCN 1:

cpe:/a:otrs:otrs_help_desk:4.0.2:*:*:*:*:*:*:*

OR cpe:/a:otrs:otrs_help_desk:3.3.10:*:*:*:*:*:*:*

OR cpe:/a:otrs:otrs_help_desk:3.2.16:*:*:*:*:*:*:*

Denotes that component is vulnerable

Oval Definitions

Definition ID	Class	Title	Last Modified
oval:org.opensuse.security:def:20149324	V	CVE-2014-9324	2022-06-30
oval:org.opensuse.security:def:113077	P	otrs-3.3.16-37.1 on GA media (Moderate)	2022-01-17
oval:org.opensuse.security:def:106514	P	Security update for apache2 (Important) (in QA)	2022-01-10
oval:org.cisecurity:def:42	P	DSA-3124-1 -- otrs2 -- security update	2016-02-08
oval:com.ubuntu.artful:def:20149324000	V	CVE-2014-9324 on Ubuntu 17.10 (artful) - medium.	2014-12-19
oval:com.ubuntu.disco:def:201493240000000	V	CVE-2014-9324 on Ubuntu 19.04 (disco) - medium.	2014-12-19
oval:com.ubuntu.trusty:def:20149324000	V	CVE-2014-9324 on Ubuntu 14.04 LTS (trusty) - medium.	2014-12-19
oval:com.ubuntu.cosmic:def:201493240000000	V	CVE-2014-9324 on Ubuntu 18.10 (cosmic) - medium.	2014-12-19
oval:com.ubuntu.bionic:def:20149324000	V	CVE-2014-9324 on Ubuntu 18.04 LTS (bionic) - medium.	2014-12-19
oval:com.ubuntu.xenial:def:20149324000	V	CVE-2014-9324 on Ubuntu 16.04 LTS (xenial) - medium.	2014-12-19
oval:com.ubuntu.bionic:def:201493240000000	V	CVE-2014-9324 on Ubuntu 18.04 LTS (bionic) - medium.	2014-12-19
oval:com.ubuntu.cosmic:def:20149324000	V	CVE-2014-9324 on Ubuntu 18.10 (cosmic) - medium.	2014-12-19
oval:com.ubuntu.xenial:def:201493240000000	V	CVE-2014-9324 on Ubuntu 16.04 LTS (xenial) - medium.	2014-12-19
oval:com.ubuntu.precise:def:20149324000	V	CVE-2014-9324 on Ubuntu 12.04 LTS (precise) - medium.	2014-12-19

BACK