CVE-2008-7277
Open Ticket Request System (OTRS) before 2.3.0-beta4 checks for the rw permission, instead of the...
Open Ticket Request System (OTRS) before 2.3.0-beta4 checks for the rw permission, instead of the configured merge permission, during authorization of merge operations, which might allow remote authenticated users to bypass intended access restrictions by merging two tickets.
Exploit likelihood
What each source reports
NVD Score used
Open Ticket Request System (OTRS) before 2.3.0-beta4 checks for the rw permission, instead of the configured merge permission, during authorization of merge operations, which might allow remote authenticated users to bypass intended access restrictions by merging two tickets.
- Record
CVE-2008-7277- CVSS 2.0
- 6.5 Medium
AV:N/AC:L/Au:S/C:P/I:P/A:P - Weakness
- CWE-264
- Updated
- 2026-11-02
CVE List No score
Open Ticket Request System (OTRS) before 2.3.0-beta4 checks for the rw permission, instead of the configured merge permission, during authorization of merge operations, which might allow remote authenticated users to bypass intended access restrictions by merging two tickets.
- Record
CVE-2008-7277- Updated
- 2026-11-02
EUVDEUVD-2008-7230 No score
Open Ticket Request System (OTRS) before 2.3.0-beta4 checks for the rw permission, instead of the configured merge permission, during authorization of merge operations, which might allow remote authenticated users to bypass intended access restrictions by merging two tickets.
- Record
EUVD-2008-7230- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-3frj-7j4q-xc89 No score
Open Ticket Request System (OTRS) before 2.3.0-beta4 checks for the rw permission, instead of the...
Open Ticket Request System (OTRS) before 2.3.0-beta4 checks for the rw permission, instead of the configured merge permission, during authorization of merge operations, which might allow remote authenticated users to bypass intended access restrictions by merging two tickets.
- Record
GHSA-3frj-7j4q-xc89- Updated
- 2026-11-02
OSV No score
Open Ticket Request System (OTRS) before 2.3.0-beta4 checks for the rw permission, instead of the configured merge permission, during authorization of merge operations, which might allow remote authenticated users to bypass intended access restrictions by merging two tickets.
- Record
CVE-2008-7277- Updated
- 2026-11-02
OSVDEBIAN-CVE-2008-7277 No score
Open Ticket Request System (OTRS) before 2.3.0-beta4 checks for the rw permission, instead of the configured merge permission, during authorization of merge operations, which might allow remote authenticated users to bypass intended access restrictions by merging two tickets.
- Record
DEBIAN-CVE-2008-7277- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
otrs2Debian:11 |
before 2.3.2-1, plus listed versions 2.0.4p01-102.0.4p01-112.0.4p01-122.0.4p01-132.0.4p01-14 Show 36 moreShow less2.0.4p01-14.12.0.4p01-152.0.4p01-162.0.4p01-172.0.4p01-182.0.4p01-62.0.4p01-72.0.4p01-82.0.4p01-92.0.99beta1-12.0.99beta1-22.1.1-12.1.3-12.1.4-12.1.4-22.1.5-12.1.5-22.1.5-32.1.6-12.1.7-12.1.7-22.2.0~beta2-12.2.0~beta3-12.2.1-12.2.2-12.2.3-12.2.4-12.2.5-12.2.5-22.2.6-12.2.7-12.2.7-22.2.7-2lenny12.2.7-2lenny22.2.7-2lenny32.2.7-3 |
2.3.2-1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2008-7277 is a medium vulnerability (CVSS 6.5) in Otrs, published March 18, 2011. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.47%, the 73rd percentile. Fixed in otrs2 2.3.2-1.