The SOAP interface in OTRS 2.1.x before 2.1.8 and 2.2.x before 2.2.6 allows remote attackers to "read and modify objects" via SOAP requests, related to "Missing security checks."

Security update: Add upstream patch for CVE-2008-1515 / OSA-2008-01 (Vulnerability in OTRS SOAP interface allowing remote access without valid SOAP user - http://otrs.org/advisory/OSA-2008-01-en/ )

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is running OTRS, a web-based ticketing request system.  The version of OTRS installed on the remote host allows a remote attacker to read and modify objects via the OTRS SOAP interface without any credentials.

The remote host is running OTRS, a web-based ticketing request system. 

The version of OTRS installed on the remote host allows a remote attacker to read and modify objects via the OTRS SOAP interface without any credentials.

An attacker could get remote access without specifying a valid username (CVE-2008-1515).

ID	Name	Product	Family	Severity
31979	Fedora 7 : otrs-2.1.5-4.fc7 (2008-3100)	Nessus	Fedora Local Security Checks	medium
4466	OTRS < 2.1.8 / 2.2.6 SOAP Interface Authentication Bypass	Nessus Network Monitor	CGI	high
31789	OTRS SOAP Interface Unauthenticated Object Manipulation	Nessus	CGI abuses	high
31776	openSUSE 10 Security Update : otrs (otrs-5144)	Nessus	SuSE Local Security Checks	medium

Detections

Analytics

CVE-2008-1515

critical

Tenable Plugins

medium

high

high

medium