CVE-2010-0438
Estado: ModificadaMedia (6.5)—
Multiple SQL injection vulnerabilities in Kernel/System/Ticket.pm in OTRS-Core in Open Ticket Request System (OTRS) 2.1.x before 2.1.9, 2.2.x before 2.2.9, 2.3.x before 2.3.5, and 2.4.x before 2.4.7 allow remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
CVSS
- Versión: 2.0
- Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P
- Puntuación base: 6.5
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 1.97%
- Percentil entre todas las CVEs puntuadas: 80
- Fecha de la puntuación: 7/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (1)
CWE
- CWE-89
Referencias
- http://lists.opensuse.org/opensuse-security-announce/2010-08/msg00001.html
- http://otrs.org/advisory/OSA-2010-01-en/
- http://otrs.org/releases/2.4.7/
- http://secunia.com/advisories/38507
- http://secunia.com/advisories/38544
- http://source.otrs.org/viewvc.cgi/otrs/Kernel/System/Ticket.pm?view=log
- http://www.osvdb.org/62181
- http://www.otrs.org/news/2010/otrs_2-4-7/
- http://www.securityfocus.com/bid/38146
- http://lists.opensuse.org/opensuse-security-announce/2010-08/msg00001.html
- http://otrs.org/advisory/OSA-2010-01-en/
- http://otrs.org/releases/2.4.7/
- http://secunia.com/advisories/38507
- http://secunia.com/advisories/38544
- http://source.otrs.org/viewvc.cgi/otrs/Kernel/System/Ticket.pm?view=log
- http://www.osvdb.org/62181
- http://www.otrs.org/news/2010/otrs_2-4-7/
- http://www.securityfocus.com/bid/38146
JSON original (NVD)
Mostrar
{
"id": "CVE-2010-0438",
"cveTags": [],
"metrics": {
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 6.5,
"accessVector": "NETWORK",
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
"authentication": "SINGLE",
"integrityImpact": "PARTIAL",
"accessComplexity": "LOW",
"availabilityImpact": "PARTIAL",
"confidentialityImpact": "PARTIAL"
},
"acInsufInfo": false,
"impactScore": 6.4,
"baseSeverity": "MEDIUM",
"obtainAllPrivilege": false,
"exploitabilityScore": 8,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
]
},
"affected": [
{
"source": "cve@mitre.org",
"affectedData": [
{
"vendor": "n/a",
"product": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
]
}
],
"published": "2010-02-09T19:30:00.453",
"references": [
{
"url": "http://lists.opensuse.org/opensuse-security-announce/2010-08/msg00001.html",
"source": "cve@mitre.org"
},
{
"url": "http://otrs.org/advisory/OSA-2010-01-en/",
"tags": [
"Vendor Advisory"
],
"source": "cve@mitre.org"
},
{
"url": "http://otrs.org/releases/2.4.7/",
"source": "cve@mitre.org"
},
{
"url": "http://secunia.com/advisories/38507",
"tags": [
"Vendor Advisory"
],
"source": "cve@mitre.org"
},
{
"url": "http://secunia.com/advisories/38544",
"source": "cve@mitre.org"
},
{
"url": "http://source.otrs.org/viewvc.cgi/otrs/Kernel/System/Ticket.pm?view=log",
"source": "cve@mitre.org"
},
{
"url": "http://www.osvdb.org/62181",
"source": "cve@mitre.org"
},
{
"url": "http://www.otrs.org/news/2010/otrs_2-4-7/",
"source": "cve@mitre.org"
},
{
"url": "http://www.securityfocus.com/bid/38146",
"source": "cve@mitre.org"
},
{
"url": "http://lists.opensuse.org/opensuse-security-announce/2010-08/msg00001.html",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://otrs.org/advisory/OSA-2010-01-en/",
"tags": [
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://otrs.org/releases/2.4.7/",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://secunia.com/advisories/38507",
"tags": [
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://secunia.com/advisories/38544",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://source.otrs.org/viewvc.cgi/otrs/Kernel/System/Ticket.pm?view=log",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.osvdb.org/62181",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.otrs.org/news/2010/otrs_2-4-7/",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.securityfocus.com/bid/38146",
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-89"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Multiple SQL injection vulnerabilities in Kernel/System/Ticket.pm in OTRS-Core in Open Ticket Request System (OTRS) 2.1.x before 2.1.9, 2.2.x before 2.2.9, 2.3.x before 2.3.5, and 2.4.x before 2.4.7 allow remote authenticated users to execute arbitrary SQL commands via unspecified vectors."
},
{
"lang": "es",
"value": "Múltiples vulnerabilidades de inyección SQL en Kernel/System/Ticket.pm en OTRS-Core en Open Ticket Request System (OTRS) v2.1.x anteriores a v2.1.9, v2.2.x anteriores a v2.2.9, v2.3.x anteriores a v2.3.5, y v2.4.x anteriores a v2.4.7 permite a usuarios autenticados ejecutar comandos SQL a través de vectores sin especificar."
}
],
"lastModified": "2026-06-16T23:16:10.810",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:otrs:otrs:2.1.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E7BAB384-AC74-4D75-BFE2-8CBC2C0A830F"
},
{
"criteria": "cpe:2.3:a:otrs:otrs:2.1.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E365F79A-BDDA-430D-B39F-FADADA91A0F6"
},
{
"criteria": "cpe:2.3:a:otrs:otrs:2.1.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "DC9223D9-B5F8-4D9A-98F8-5D73852B2E0C"
},
{
"criteria": "cpe:2.3:a:otrs:otrs:2.1.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "BC91C532-9CCD-4353-A6C3-E297A1F5BD77"
},
{
"criteria": "cpe:2.3:a:otrs:otrs:2.1.5:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6BAAB79E-8DC5-4BFF-9BD2-9215DA2B775D"
},
{
"criteria": "cpe:2.3:a:otrs:otrs:2.1.6:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E9C7B601-0CBD-4861-855E-A4F64157A8D3"
},
{
"criteria": "cpe:2.3:a:otrs:otrs:2.1.7:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B715EC14-D79A-4CB4-A875-380F66A45C3D"
},
{
"criteria": "cpe:2.3:a:otrs:otrs:2.1.8:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "20C9C4DB-4E5D-4D01-B174-D6682831B184"
},
{
"criteria": "cpe:2.3:a:otrs:otrs:2.2.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "091E423C-A9D5-4ED8-93C7-5CDD57DC3B00"
},
{
"criteria": "cpe:2.3:a:otrs:otrs:2.2.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "CAEC4E93-34C5-418B-B12C-CABE500D5171"
},
{
"criteria": "cpe:2.3:a:otrs:otrs:2.2.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "75BE131A-342E-475C-9522-E53A8A8A1BA0"
},
{
"criteria": "cpe:2.3:a:otrs:otrs:2.2.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "EF62E279-212F-40B4-B2B3-429D6A6164BA"
},
{
"criteria": "cpe:2.3:a:otrs:otrs:2.2.5:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D6FEFC32-3880-4CEA-9AD1-B1669A3CACE7"
},
{
"criteria": "cpe:2.3:a:otrs:otrs:2.2.6:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A0A9CD5E-655A-423B-805B-8953122D2509"
},
{
"criteria": "cpe:2.3:a:otrs:otrs:2.2.7:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "64BCF69B-4DB6-423E-BCE9-7CAEA74B1568"
},
{
"criteria": "cpe:2.3:a:otrs:otrs:2.2.8:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "9307C840-9EEE-4A23-8FAF-258D683E14A0"
},
{
"criteria": "cpe:2.3:a:otrs:otrs:2.3.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "55F536B9-11F6-4F3F-9293-25D23F987C9E"
},
{
"criteria": "cpe:2.3:a:otrs:otrs:2.3.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "CD6DF09D-A8D8-4C77-A4C9-46BD570C2CE1"
},
{
"criteria": "cpe:2.3:a:otrs:otrs:2.3.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D7ECE7F6-7A82-420C-A440-522331667B43"
},
{
"criteria": "cpe:2.3:a:otrs:otrs:2.3.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6C66917F-135E-464E-916F-FD6B5A701E65"
},
{
"criteria": "cpe:2.3:a:otrs:otrs:2.4.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "724A9C40-AE96-4AD5-BEB2-6C496F4C361D"
},
{
"criteria": "cpe:2.3:a:otrs:otrs:2.4.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8AA5A554-016E-4CFB-A809-991B6902C3FA"
},
{
"criteria": "cpe:2.3:a:otrs:otrs:2.4.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3821A8EF-ED18-49DD-BF52-DFDD982E35C6"
},
{
"criteria": "cpe:2.3:a:otrs:otrs:2.4.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B41C77DB-BC99-4C50-BD86-FECB44ACF0A8"
},
{
"criteria": "cpe:2.3:a:otrs:otrs:2.4.5:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C9D7CBCB-F4B8-4ACC-86C8-E45358F48697"
},
{
"criteria": "cpe:2.3:a:otrs:otrs:2.4.6:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "CB4EAE42-96BD-4B25-BFCC-6CFBF08F339C"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "cve@mitre.org"
}