OTRS 'AdminPackageManager.pm' Local File Disclosure Vulnerability

Bugtraq ID:	49251
Class:	Input Validation Error
CVE:	CVE-2011-2746
Remote:	Yes
Local:	No
Published:	Aug 19 2011 12:00AM
Updated:	Aug 19 2011 12:00AM
Credit:	Reported by the vendor.
Vulnerable:	OTRS OTRS 3.0.7 OTRS OTRS 3.0.6 OTRS OTRS 3.0.5 OTRS OTRS 2.4.10 OTRS OTRS 2.4.9 OTRS OTRS 2.4.8 OTRS OTRS 2.4.7 OTRS OTRS 2.4.6 OTRS OTRS 2.4.5 OTRS OTRS 2.4.4 OTRS OTRS 2.4.3 OTRS OTRS 2.4.2 OTRS OTRS 3.0.4 OTRS OTRS 3.0.3 OTRS OTRS 3.0.2 OTRS OTRS 3.0.1 OTRS OTRS 2.4.1
Not Vulnerable:	OTRS OTRS 3.0.10 OTRS OTRS 2.4.11

OTRS 'AdminPackageManager.pm' Local File Disclosure Vulnerability

OTRS is prone to a local file-disclosure vulnerability because it fails to adequately validate user-supplied input.

Exploiting this vulnerability would allow an attacker to obtain potentially sensitive information from local files on computers running the vulnerable application. This may aid in further attacks.

OTRS 'AdminPackageManager.pm' Local File Disclosure Vulnerability

Attackers may exploit this issue through a browser.

OTRS 'AdminPackageManager.pm' Local File Disclosure Vulnerability

Solution:
Updates are available. Please see the references for more information.

OTRS 'AdminPackageManager.pm' Local File Disclosure Vulnerability

References:

• OTRS Homepage (OTRS )
  
• OTRS Security Advisory 2011-03 (OTRS)