CVE-2019-13457: 
Linux openSUSE vulnerability analysis and mitigation

CVE-2019-13457 affects Open Ticket Request System (OTRS) versions 7.0.x through 7.0.8. The vulnerability was discovered in July 2019 and allows a customer user to access information from their company tickets through search results, even when the CustomerDisableCompanyTicketAccess setting is enabled (OTRS Advisory).

The vulnerability has a CVSS v3.0 base score of 4.3 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. This indicates a network-accessible vulnerability requiring low attack complexity and low privileges, with no user interaction needed. The scope is unchanged, and it only impacts confidentiality with no effect on integrity or availability (NVD).

The vulnerability allows unauthorized access to company ticket information when the CustomerDisableCompanyTicketAccess setting is enabled. A customer user can bypass intended access restrictions to view tickets associated with their CustomerID, potentially exposing sensitive information (OTRS Advisory).

The vulnerability was fixed in OTRS version 7.0.9. Organizations running affected versions should upgrade to the patched version. The fix is available through the official OTRS download channels (OTRS Advisory).