Summary
Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in OTRS ausnutzen, um beliebigen Code auszuführen, einen Cross-Site-Scripting-Angriff auszuführen und vertrauliche Informationen offenzulegen.
Product
Das Open Ticket Request System (OTRS) ist ein Ticketsystem für Help-Desks.
Vulnerabilities 3
-
Medium 6.4
Authenticated remote code execution
Specially crafted string in OTRS system configuration can allow the execution of any system command.
-
Medium 4.3
Information disclosure in the External Interface
Accounted time is shown in the Ticket Detail View (External Interface), even if ExternalFrontend::TicketDetailView###AccountedTimeDisplay is disabled.
-
Low 3.5
Possible XSS attack via translation
Malicious translator is able to inject JavaScript code in few translatable strings (where HTML is allowed). The code could be executed in the Package manager. This issue affects: OTRS AG OTRS 7.0.x version: 7.0.32 and prior versions, 8.0.x version: 8.0.19 and…
Revision history
-
#3
Neue Updates von Debian aufgenommen
-
#2
Exploit für CVE-2021-36100 aufgenommen
-
#1
Initiale Fassung
References
-
Debian Security Advisory DLA-3551 vom 2023-08-31
https://lists.debian.org/debian-lts-announce/2023/08/msg00040.html
-
OTRS Security Advisory vom 2022-03-20
https://otrs.com/release-notes/otrs-security-advisory-2022-03/
-
OTRS Security Advisory vom 2022-03-20
https://otrs.com/release-notes/otrs-security-advisory-2022-05/
-
OTRS Security Advisory vom 2022-03-20
https://otrs.com/release-notes/otrs-security-advisory-2022-06/
-
Exploit CVE-2021-36100 vom 2022-07-14
https://github.com/post-cyberlabs/Exploits/blob/main/CVE-2021-36100.py