Incorrect Privilege Assignment in Inline Editing Can Lead to Privilege Escalation

CVE-2024-23794

What is CVE-2024-23794?

An incorrect privilege assignment vulnerability exists in the inline editing functionality of OTRS. This flaw allows agents with only read-only permissions to elevate their access, potentially gaining full control over tickets. The vulnerability is triggered under rare circumstances when the system configuration contains the 'RequiredLock' setting of 'AgentFrontend::Ticket::InlineEditing::Property###Watch' enabled by an administrator. This issue compromises the integrity of user permissions and is applicable to specific OTRS versions.

References