High severity · published Jul 15, 2024
CVE-2024-23794
Agents are able to lock the ticket without the "Owner" permission
7.5
CVSS
0.3%
EPSS
No
On KEV
Description
An incorrect privilege assignment vulnerability in the inline editing functionality of OTRS can lead to privilege escalation. This flaw allows an agent with read-only permissions to gain full access to a ticket. This issue arises in very rare instances when an admin has previously enabled the setting 'RequiredLock' of 'AgentFrontend::Ticket::InlineEditing::Property###Watch' in the system configuration.This issue affects OTRS:
* 8.0.X
* 2023.X
* from 2024.X through 2024.4.x
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
High
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 19% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OT
OTRS · OTRS AG
8.0.x; 2023.x; 2024.x through 2024.4.x · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-23794
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-23794
Vendor Advisory
https://otrs.com/release-notes/otrs-security-advisory-2024-06/
More from OTRS
9.1
CVE-2026-48188
SQL Injection via MySQL Quote Method
8.2
CVE-2024-43444
Passwords are written to Admin Log Module
7.1
CVE-2026-48209
Reflected XSS in authenticated agent context
6.8
CVE-2025-24390
Missing Cookie Flags
6.5
CVE-2026-48208
Denial-of-Service via SVG Rendering in Ticket