CWE Code: 269
Vulnerability Type: privilege_escalation
CVSS Score: 6.5
CWE Name:  Improper Privilege Management
Summary: in open ticket request system (otrs) 3.3.x through 3.3.16, 4.x through 4.0.23, and 5.x through 5.0.19, an attacker with agent permission is capable of opening a specific url in a browser to gain administrative privileges / full access. afterward, all system settings can be read and changed. the urls in question contain index.pl?action=installer with ;subaction=intro or ;subaction=start or ;subaction=system appended at the end.
Access Authentication: SINGLE
Access Complexity: LOW
Access Vector: NETWORK
Impact (C/I/A): PARTIAL/PARTIAL/PARTIAL
Published Date: 2017-06-12
Last Modified Date: 2019-10-03