Skip to content
OpenAdvisories
Medium WID-SEC-2023-2223 5 CVEs

OTRS: Mehrere Schwachstellen

Published Mar 26, 2020 · Updated Aug 30, 2023 · Revision 3 · de-DE

Vendor: Debian Vendor: OTRS Product: Linux Product: OTRS Product: OTRS < 5.0.42_Community Product: OTRS < 6.0.27_Community Product: OTRS < 7.0.16 Platform: Linux Platform: macOS Platform: Windows

Summary

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in OTRS ausnutzen, um Sicherheitsvorkehrungen zu umgehen, Informationen offenzulegen oder einen Cross-Site-Scripting-Angriff durchzuführen.

Product

Das Open Ticket Request System (OTRS) ist ein Ticketsystem für Help-Desks.

Vulnerabilities 5

  • High 7.3
    CVE-2020-1773

    Session / Password / Password token leak

    An attacker with the ability to generate session IDs or password reset tokens, either by being able to authenticate or by exploiting OSA-2020-09, may be able to predict other users session IDs, password reset tokens and automatically generated passwords. This…

    OTRS OTRS ((OTRS)) Community Edition otrs2 Debian Ubuntu
  • Medium 6.5
    CVE-2020-1772

    Information Disclosure

    It's possible to craft Lost Password requests with wildcards in the Token value, which allows attacker to retrieve valid Token(s), generated by users which already requested new passwords. This issue affects: ((OTRS)) Community Edition 5.0.41 and prior versio…

    OTRS OTRS ((OTRS)) Community Edition otrs2 Debian Ubuntu
  • Medium 4.6
    CVE-2020-1771

    Possible XSS in Customer user address book

    Attacker is able craft an article with a link to the customer address book with malicious content (JavaScript). When agent opens the link, JavaScript code is executed due to the missing parameter encoding. This issue affects: ((OTRS)) Community Edition: 6.0.2…

    OTRS OTRS ((OTRS)) Community Edition otrs2 Debian Ubuntu
  • Low 3.5
    CVE-2020-1769

    Autocomplete in the form login screens

    In the login screens (in agent and customer interface), Username and Password fields use autocomplete, which might be considered as security issue. This issue affects: ((OTRS)) Community Edition: 5.0.41 and prior versions, 6.0.26 and prior versions. OTRS: 7.0…

    OTRS OTRS ((OTRS)) Community Edition otrs2 Debian Ubuntu
  • Low 2.4
    CVE-2020-1770

    Information disclosure in support bundle files

    Support bundle generated files could contain sensitive information that might be unwanted to be disclosed. This issue affects: ((OTRS)) Community Edition: 5.0.41 and prior versions, 6.0.26 and prior versions. OTRS: 7.0.15 and prior versions.

    OTRS OTRS ((OTRS)) Community Edition otrs2 Debian Ubuntu

Revision history

  1. #3

    Neue Updates von Debian aufgenommen

  2. #2

    Neue Updates von Debian aufgenommen

  3. #1

    Initiale Fassung

References