CVE-2010-0438
Status: ModifiedMedium (6.5)—
Multiple SQL injection vulnerabilities in Kernel/System/Ticket.pm in OTRS-Core in Open Ticket Request System (OTRS) 2.1.x before 2.1.9, 2.2.x before 2.2.9, 2.3.x before 2.3.5, and 2.4.x before 2.4.7 allow remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
CVSS
- Version: 2.0
- Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P
- Base score: 6.5
Exploitation probability (EPSS)
- Probability of exploitation in the next 30 days: 1.97%
- Percentile among all scored CVEs: 80
- Score date: 10/7/2026
EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).
Affected technologies (1)
CWEs
- CWE-89
References
- http://lists.opensuse.org/opensuse-security-announce/2010-08/msg00001.html
- http://otrs.org/advisory/OSA-2010-01-en/
- http://otrs.org/releases/2.4.7/
- http://secunia.com/advisories/38507
- http://secunia.com/advisories/38544
- http://source.otrs.org/viewvc.cgi/otrs/Kernel/System/Ticket.pm?view=log
- http://www.osvdb.org/62181
- http://www.otrs.org/news/2010/otrs_2-4-7/
- http://www.securityfocus.com/bid/38146
- http://lists.opensuse.org/opensuse-security-announce/2010-08/msg00001.html
- http://otrs.org/advisory/OSA-2010-01-en/
- http://otrs.org/releases/2.4.7/
- http://secunia.com/advisories/38507
- http://secunia.com/advisories/38544
- http://source.otrs.org/viewvc.cgi/otrs/Kernel/System/Ticket.pm?view=log
- http://www.osvdb.org/62181
- http://www.otrs.org/news/2010/otrs_2-4-7/
- http://www.securityfocus.com/bid/38146
Raw JSON (NVD)
Show
{
"id": "CVE-2010-0438",
"cveTags": [],
"metrics": {
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 6.5,
"accessVector": "NETWORK",
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
"authentication": "SINGLE",
"integrityImpact": "PARTIAL",
"accessComplexity": "LOW",
"availabilityImpact": "PARTIAL",
"confidentialityImpact": "PARTIAL"
},
"acInsufInfo": false,
"impactScore": 6.4,
"baseSeverity": "MEDIUM",
"obtainAllPrivilege": false,
"exploitabilityScore": 8,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
]
},
"affected": [
{
"source": "cve@mitre.org",
"affectedData": [
{
"vendor": "n/a",
"product": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
]
}
],
"published": "2010-02-09T19:30:00.453",
"references": [
{
"url": "http://lists.opensuse.org/opensuse-security-announce/2010-08/msg00001.html",
"source": "cve@mitre.org"
},
{
"url": "http://otrs.org/advisory/OSA-2010-01-en/",
"tags": [
"Vendor Advisory"
],
"source": "cve@mitre.org"
},
{
"url": "http://otrs.org/releases/2.4.7/",
"source": "cve@mitre.org"
},
{
"url": "http://secunia.com/advisories/38507",
"tags": [
"Vendor Advisory"
],
"source": "cve@mitre.org"
},
{
"url": "http://secunia.com/advisories/38544",
"source": "cve@mitre.org"
},
{
"url": "http://source.otrs.org/viewvc.cgi/otrs/Kernel/System/Ticket.pm?view=log",
"source": "cve@mitre.org"
},
{
"url": "http://www.osvdb.org/62181",
"source": "cve@mitre.org"
},
{
"url": "http://www.otrs.org/news/2010/otrs_2-4-7/",
"source": "cve@mitre.org"
},
{
"url": "http://www.securityfocus.com/bid/38146",
"source": "cve@mitre.org"
},
{
"url": "http://lists.opensuse.org/opensuse-security-announce/2010-08/msg00001.html",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://otrs.org/advisory/OSA-2010-01-en/",
"tags": [
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://otrs.org/releases/2.4.7/",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://secunia.com/advisories/38507",
"tags": [
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://secunia.com/advisories/38544",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://source.otrs.org/viewvc.cgi/otrs/Kernel/System/Ticket.pm?view=log",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.osvdb.org/62181",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.otrs.org/news/2010/otrs_2-4-7/",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.securityfocus.com/bid/38146",
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-89"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Multiple SQL injection vulnerabilities in Kernel/System/Ticket.pm in OTRS-Core in Open Ticket Request System (OTRS) 2.1.x before 2.1.9, 2.2.x before 2.2.9, 2.3.x before 2.3.5, and 2.4.x before 2.4.7 allow remote authenticated users to execute arbitrary SQL commands via unspecified vectors."
},
{
"lang": "es",
"value": "Múltiples vulnerabilidades de inyección SQL en Kernel/System/Ticket.pm en OTRS-Core en Open Ticket Request System (OTRS) v2.1.x anteriores a v2.1.9, v2.2.x anteriores a v2.2.9, v2.3.x anteriores a v2.3.5, y v2.4.x anteriores a v2.4.7 permite a usuarios autenticados ejecutar comandos SQL a través de vectores sin especificar."
}
],
"lastModified": "2026-06-16T23:16:10.810",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:otrs:otrs:2.1.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E7BAB384-AC74-4D75-BFE2-8CBC2C0A830F"
},
{
"criteria": "cpe:2.3:a:otrs:otrs:2.1.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E365F79A-BDDA-430D-B39F-FADADA91A0F6"
},
{
"criteria": "cpe:2.3:a:otrs:otrs:2.1.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "DC9223D9-B5F8-4D9A-98F8-5D73852B2E0C"
},
{
"criteria": "cpe:2.3:a:otrs:otrs:2.1.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "BC91C532-9CCD-4353-A6C3-E297A1F5BD77"
},
{
"criteria": "cpe:2.3:a:otrs:otrs:2.1.5:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6BAAB79E-8DC5-4BFF-9BD2-9215DA2B775D"
},
{
"criteria": "cpe:2.3:a:otrs:otrs:2.1.6:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E9C7B601-0CBD-4861-855E-A4F64157A8D3"
},
{
"criteria": "cpe:2.3:a:otrs:otrs:2.1.7:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B715EC14-D79A-4CB4-A875-380F66A45C3D"
},
{
"criteria": "cpe:2.3:a:otrs:otrs:2.1.8:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "20C9C4DB-4E5D-4D01-B174-D6682831B184"
},
{
"criteria": "cpe:2.3:a:otrs:otrs:2.2.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "091E423C-A9D5-4ED8-93C7-5CDD57DC3B00"
},
{
"criteria": "cpe:2.3:a:otrs:otrs:2.2.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "CAEC4E93-34C5-418B-B12C-CABE500D5171"
},
{
"criteria": "cpe:2.3:a:otrs:otrs:2.2.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "75BE131A-342E-475C-9522-E53A8A8A1BA0"
},
{
"criteria": "cpe:2.3:a:otrs:otrs:2.2.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "EF62E279-212F-40B4-B2B3-429D6A6164BA"
},
{
"criteria": "cpe:2.3:a:otrs:otrs:2.2.5:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D6FEFC32-3880-4CEA-9AD1-B1669A3CACE7"
},
{
"criteria": "cpe:2.3:a:otrs:otrs:2.2.6:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A0A9CD5E-655A-423B-805B-8953122D2509"
},
{
"criteria": "cpe:2.3:a:otrs:otrs:2.2.7:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "64BCF69B-4DB6-423E-BCE9-7CAEA74B1568"
},
{
"criteria": "cpe:2.3:a:otrs:otrs:2.2.8:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "9307C840-9EEE-4A23-8FAF-258D683E14A0"
},
{
"criteria": "cpe:2.3:a:otrs:otrs:2.3.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "55F536B9-11F6-4F3F-9293-25D23F987C9E"
},
{
"criteria": "cpe:2.3:a:otrs:otrs:2.3.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "CD6DF09D-A8D8-4C77-A4C9-46BD570C2CE1"
},
{
"criteria": "cpe:2.3:a:otrs:otrs:2.3.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D7ECE7F6-7A82-420C-A440-522331667B43"
},
{
"criteria": "cpe:2.3:a:otrs:otrs:2.3.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6C66917F-135E-464E-916F-FD6B5A701E65"
},
{
"criteria": "cpe:2.3:a:otrs:otrs:2.4.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "724A9C40-AE96-4AD5-BEB2-6C496F4C361D"
},
{
"criteria": "cpe:2.3:a:otrs:otrs:2.4.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8AA5A554-016E-4CFB-A809-991B6902C3FA"
},
{
"criteria": "cpe:2.3:a:otrs:otrs:2.4.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3821A8EF-ED18-49DD-BF52-DFDD982E35C6"
},
{
"criteria": "cpe:2.3:a:otrs:otrs:2.4.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B41C77DB-BC99-4C50-BD86-FECB44ACF0A8"
},
{
"criteria": "cpe:2.3:a:otrs:otrs:2.4.5:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C9D7CBCB-F4B8-4ACC-86C8-E45358F48697"
},
{
"criteria": "cpe:2.3:a:otrs:otrs:2.4.6:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "CB4EAE42-96BD-4B25-BFCC-6CFBF08F339C"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "cve@mitre.org"
}