RT/RTIR: Modifying private tickets via UUID spoofing

[rommelfs]

In a sharing environment where org A and org B are present. org B has a ticket with UUID X, which is private (not shared) org A has a ticket and sets it to UUID X. The non-shared org B ticket is being modified.

[intrasoft-rmalik]

@rommelfs thanks for this. We will investigate this further.

[majidsalehighamsari]

This is correct, User should not edit UUID manually, We have to set the UUID input field to read only or hidden field.

[rommelfs]

Great, that's really good to hear. While you're on it, please make sure it can not be modified through the command line interface RT client, the REST API or modified POST requests. If you could think of other ways, feel free to add them to the list.

[iglocska]

Even better, let's hope that no CSP user ever gains access to their SQL. Or perhaps, having a mechanism that doesn't allow any modifications from other CSP nodes to private data / no way to take over tickets would be even more helpful.