CVE-2019-12746

An issue was discovered in Open Ticket Request System (OTRS) Community Edition 5.0.x through 5.0.36 and 6.0.x through 6.0.19. A user logged into OTRS as an agent might unknowingly disclose their session ID by sharing the link of an embedded ticket article with third parties. This identifier can be then be potentially abused in order to impersonate the agent user.

• CWE-200

• http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00038.htmlBroken Link
• http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00066.htmlBroken Link
• http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00077.htmlBroken Link
• https://community.otrs.com/security-advisory-2019-10-security-update-for-otrs-framework/Patch, Vendor Advisory
• https://lists.debian.org/debian-lts-announce/2019/08/msg00018.htmlMailing List, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2023/08/msg00040.html
• https://www.otrs.com/category/release-and-security-notes-en/Release Notes
• http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00038.htmlBroken Link
• http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00066.htmlBroken Link
• http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00077.htmlBroken Link
• https://community.otrs.com/security-advisory-2019-10-security-update-for-otrs-framework/Patch, Vendor Advisory
• https://lists.debian.org/debian-lts-announce/2019/08/msg00018.htmlMailing List, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2023/08/msg00040.html
• https://www.otrs.com/category/release-and-security-notes-en/Release Notes

Published

Aug 21, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-1274An information disclosure vulnerability exists when the Wind…5.5
• CVE-2019-12741XSS exists in the HAPI FHIR testpage overlay module of the H…
• CVE-2019-12742Bludit prior to 3.9.1 allows a non-privileged user to change…
• CVE-2019-12743HumHub Social Network Kit Enterprise v1.3.13 allows remote a…
• CVE-2019-12744SeedDMS before 5.1.11 allows Remote Command Execution (RCE) …
• CVE-2019-12745out/out.UsrMgr.php in SeedDMS before 5.1.11 allows Stored Cr…
• CVE-2019-12747TYPO3 8.x through 8.7.26 and 9.x through 9.5.7 allows Deseri…8.8
• CVE-2019-12748TYPO3 8.3.0 through 8.7.26 and 9.0.0 through 9.5.7 allows XS…6.1
• CVE-2019-12749dbus before 1.10.28, 1.12.x before 1.12.16, and 1.13.x befor…7.1
• CVE-2019-1275Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2019-12750Symantec Endpoint Protection, prior to 14.2 RU1 & 12.1 RU6 M…
• CVE-2019-12751Symantec Messaging Gateway, prior to 10.7.1, may be suscepti…