title: Tickets can be moved without permissions
description: An improper privilege check in the OTRS ticket move action in the agent interface allows   any as agent authenticated attacker to  to perform a move of an ticket without the needed permission.
This issue affects OTRS: from 8.0.X before 8.0.35.
problem types: CWE-269 Improper Privilege Management
affected:
{
defaultStatus: affected
modules: Agent interface
product: OTRS
vendor: OTRS AG
versions:
lessThan: 8.0.35, status: affected, version: 8.0.x, versionType: Patch
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.1
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N
version: 3.1
]
format: CVSS
scenarios: GENERAL
solutions: Update to OTRS 8.0.35