Cerberus Helpdesk Ticket Parameter Unauthorized Access Vulnerability

Bugtraq ID:	19797
Class:	Access Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Sep 01 2006 12:00AM
Updated:	Sep 05 2006 08:03PM
Credit:	Nicholas Hudson is credited with the discovery of this vulnerability.
Vulnerable:	Cerberus Helpdesk 3.2.Build 317
Not Vulnerable:

Cerberus Helpdesk Ticket Parameter Unauthorized Access Vulnerability

Cerberus Helpdesk is prone to an unauthorized-access vulnerability because the application fails to verify the ticket parameter properly, resulting in an improper-access validation. An update that addresses this issue is available.

An attacker can exploit this vulnerability to retrieve arbitrary tickets of other users. Information obtained can lead to a compromise of other users' confidential information.

Version 3.2 Build 317 is affected by this issue; other versions may be vulnerable as well.

Cerberus Helpdesk Ticket Parameter Unauthorized Access Vulnerability

No exploit is required.

Cerberus Helpdesk Ticket Parameter Unauthorized Access Vulnerability

Solution:
The vendor has fixed this vulnerability in the latest version available through CVS. Please see the references for more information.

Cerberus Helpdesk Ticket Parameter Unauthorized Access Vulnerability

References:

• HelpDesk Product Page (Cerberus)
  
• Helpdesk Support Page (Cerberus)