CVE-2011-1433 Information disclosure in n/a
Attackers can read cleartext user credentials from database session data in OTRS, leading to sensitive information disclosure.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2011-1433?
CVE-2011-1433 is a medium-severity vulnerability in Otrs Otrs, published on 18 Mar 2011. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The (1) AgentInterface and (2) CustomerInterface components in Open Ticket Request System (OTRS) before 3.0.6 place cleartext credentials into the session data in the database, which makes it easier for context-dependent attackers to obtain sensitive information by reading the _UserLogin and _UserPW fields.
Weakness: CWE-310
Which versions are affected by CVE-2011-1433?
It affects 1 product.
Products include Otrs Otrs.
How do I fix CVE-2011-1433?
Upgrade to a fixed version.
Is CVE-2011-1433 being exploited?
There is no known exploitation of CVE-2011-1433 in the wild and no public exploit code.
Other vulnerabilities in Otrs Otrs
Sources
Also known as DEBIAN-CVE-2011-1433, GHSA-8pwh-g3mh-g2qj.