{"id":"CVE-2013-2625","aliases":["DEBIAN-CVE-2013-2625","EUVD-2013-2564","GHSA-87rp-gwq4-fx5h","openSUSE-SU-2024:10073-1"],"status":"published","title":"An Access Bypass issue exists in OTRS Help Desk before 3.2.4, 3.1.14, and 3.0.19, OTRS ITSM...","description":"An Access Bypass issue exists in OTRS Help Desk before 3.2.4, 3.1.14, and 3.0.19, OTRS ITSM before 3.2.3, 3.1.8, and 3.0.7, and FAQ before 2.2.3, 2.1.4, and 2.0.8. Access rights by the object linking mechanism is not verified","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.01291,"percentile":0.70455,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-269"],"published":"2019-11-27T18:08:35Z","modified":"2026-08-04T06:03:36Z","fixes":[{"ecosystem":"Debian:11","package":"otrs2","fixed_in":["3.1.7+dfsg1-8"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:11","package":"otrs2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.7+dfsg1-8"}]}],"versions":["2.0.4p01-10","2.0.4p01-11","2.0.4p01-12","2.0.4p01-13","2.0.4p01-14","2.0.4p01-14.1","2.0.4p01-15","2.0.4p01-16","2.0.4p01-17","2.0.4p01-18","2.0.4p01-6","2.0.4p01-7","2.0.4p01-8","2.0.4p01-9","2.0.99beta1-1","2.0.99beta1-2","2.1.1-1","2.1.3-1","2.1.4-1","2.1.4-2","2.1.5-1","2.1.5-2","2.1.5-3","2.1.6-1","2.1.7-1","2.1.7-2","2.2.0~beta2-1","2.2.0~beta3-1","2.2.1-1","2.2.2-1","2.2.3-1","2.2.4-1","2.2.5-1","2.2.5-2","2.2.6-1","2.2.7-1","2.2.7-2","2.2.7-2lenny1","2.2.7-2lenny2","2.2.7-2lenny3","2.2.7-3","2.3.2-1","2.3.2-2","2.3.3-1","2.3.4-1","2.3.4-2","2.3.4-3","2.3.4-4","2.3.4-5","2.3.4-6","2.3.4-7","2.4.10+dfsg1-1","2.4.10+dfsg1-2","2.4.10+dfsg1-3","2.4.5-1","2.4.5-2","2.4.5-3","2.4.5-4","2.4.5-5","2.4.6-1","2.4.6-2","2.4.7+dfsg1-1","2.4.7-1","2.4.7-2","2.4.7-3","2.4.7-4","2.4.7-5","2.4.7-6","2.4.8+dfsg1-1","2.4.9+dfsg1-1","2.4.9+dfsg1-2","2.4.9+dfsg1-3","2.4.9+dfsg1-3+squeeze1","2.4.9+dfsg1-3+squeeze3","2.4.9+dfsg1-3+squeeze4","2.4.9+dfsg1-3+squeeze5","2.4.9+dfsg1-4","2.4.9+dfsg1-5","3.0.10+dfsg1-1","3.0.10+dfsg1-2","3.0.11+dfsg1-1","3.0.8+dfsg1-1","3.0.9+dfsg1-1","3.1.0~beta4+dfsg1-1","3.1.0~beta5+dfsg1-1","3.1.0~rc1+dfsg1-1","3.1.1+dfsg1-1","3.1.1+dfsg1-2","3.1.2+dfsg1-1","3.1.2+dfsg1-2","3.1.2+dfsg1-3","3.1.3+dfsg1-1","3.1.3+dfsg1-2","3.1.4+dfsg1-1","3.1.5+dfsg1-1","3.1.5+dfsg1-2","3.1.5+dfsg1-3","3.1.6+dfsg1-1","3.1.7+dfsg1-1","3.1.7+dfsg1-2","3.1.7+dfsg1-3","3.1.7+dfsg1-4","3.1.7+dfsg1-5","3.1.7+dfsg1-6","3.1.7+dfsg1-7"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"otrs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.14-37.1"}]}],"bundled":14}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"opensuse","product":"opensuse"},{"vendor":"otrs","product":"faq"},{"vendor":"otrs","product":"otrs_help_desk"},{"vendor":"otrs","product":"otrs_itsm"}],"references":[{"url":"https://security-tracker.debian.org/tracker/CVE-2013-2625","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory"]},{"url":"http://lists.opensuse.org/opensuse-updates/2013-08/msg00027.html","tags":["x_refsource_MISC","x_transferred","Release Notes","Third Party Advisory","advisory"]},{"url":"http://archives.neohapsis.com/archives/bugtraq/2013-08/0009.html","tags":["x_refsource_MISC","x_transferred","Broken Link","Third Party Advisory","advisory","web"]},{"url":"http://www.securityfocus.com/bid/58936","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/83287","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-2625"},{"url":"https://github.com/advisories/GHSA-87rp-gwq4-fx5h"},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2012-2582","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-4600","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-4751","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-2625","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-2637","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-3551","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4088","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4717","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4718","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-1695","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-2553","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-2554","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9324","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9139","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2013-2625","description":"An Access Bypass issue exists in OTRS Help Desk before 3.2.4, 3.1.14, and 3.0.19, OTRS ITSM before 3.2.3, 3.1.8, and 3.0.7, and FAQ before 2.2.3, 2.1.4, and 2.0.8. Access rights by the object linking mechanism is not verified","status":"published","published":"2019-11-27T18:08:35Z","modified":"2024-08-06T15:44:32.364Z","updated_at":"2026-11-02T14:34:55.825574Z"}],"euvd":[{"id":"EUVD-2013-2564","description":"An Access Bypass issue exists in OTRS Help Desk before 3.2.4, 3.1.14, and 3.0.19, OTRS ITSM before 3.2.3, 3.1.8, and 3.0.7, and FAQ before 2.2.3, 2.1.4, and 2.0.8. Access rights by the object linking mechanism is not verified","status":"published","published":"2019-11-27T18:08:35Z","modified":"2024-08-06T15:44:32Z","updated_at":"2026-11-03T01:56:38.194266Z"}],"ghsa":[{"id":"GHSA-87rp-gwq4-fx5h","title":"An Access Bypass issue exists in OTRS Help Desk before 3.2.4, 3.1.14, and 3.0.19, OTRS ITSM...","description":"An Access Bypass issue exists in OTRS Help Desk before 3.2.4, 3.1.14, and 3.0.19, OTRS ITSM before 3.2.3, 3.1.8, and 3.0.7, and FAQ before 2.2.3, 2.1.4, and 2.0.8. Access rights by the object linking mechanism is not verified","status":"published","published":"2022-05-05T00:29:07Z","modified":"2023-02-01T05:01:50Z","updated_at":"2026-11-02T14:49:47.696223Z"}],"nvd":[{"id":"CVE-2013-2625","description":"An Access Bypass issue exists in OTRS Help Desk before 3.2.4, 3.1.14, and 3.0.19, OTRS ITSM before 3.2.3, 3.1.8, and 3.0.7, and FAQ before 2.2.3, 2.1.4, and 2.0.8. Access rights by the object linking mechanism is not verified","status":"published","published":"2019-11-27T19:15:11.713Z","modified":"2026-06-16T23:53:43.833Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":6.4,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-269"],"updated_at":"2026-11-02T14:02:52.545039Z"}],"osv":[{"id":"CVE-2013-2625","description":"An Access Bypass issue exists in OTRS Help Desk before 3.2.4, 3.1.14, and 3.0.19, OTRS ITSM before 3.2.3, 3.1.8, and 3.0.7, and FAQ before 2.2.3, 2.1.4, and 2.0.8. Access rights by the object linking mechanism is not verified","status":"published","published":"2019-11-27T19:15:11Z","modified":"2026-04-10T03:44:27.521927Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:43:59.09154Z"},{"id":"DEBIAN-CVE-2013-2625","description":"An Access Bypass issue exists in OTRS Help Desk before 3.2.4, 3.1.14, and 3.0.19, OTRS ITSM before 3.2.3, 3.1.8, and 3.0.7, and FAQ before 2.2.3, 2.1.4, and 2.0.8. Access rights by the object linking mechanism is not verified","status":"published","published":"2019-11-27T19:15:11.713Z","modified":"2026-08-04T06:03:36.37213645Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:25.514579Z"},{"id":"openSUSE-SU-2024:10073-1","title":"otrs-3.3.16-37.1 on GA media","description":"These are all security issues fixed in the otrs-3.3.16-37.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2025-05-07T18:08:45.49578Z","updated_at":"2026-11-02T16:58:33.135986Z"}]}}