CVE-2021-36097 — Agents are able to lock the ticket without the "Owner" permission
Agents are able to lock the ticket without the "Owner" permission. Once the ticket is locked, it could be moved to the queue where the agent has "rw" permissions and gain a full…
Published: 2021-10-18 · CVSS: 3.5 · CVSS 3.1
Agents are able to lock the ticket without the "Owner" permission. Once the ticket is locked, it could be moved to the queue where the agent has "rw" permissions and gain a full control. This issue affects: OTRS AG OTRS 8.0.x version: 8.0.16 and prior versions.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7