Skip to content
OpenAdvisories
Medium WID-SEC-2023-2224 3 CVEs

OTRS: Mehrere Schwachstellen

Published Jan 13, 2020 · Updated Aug 30, 2023 · Revision 3 · de-DE

Vendor: Debian Vendor: OTRS Product: Linux Product: OTRS Product: OTRS < 7.0.14 Product: OTRS <= 5.0.39_community Product: OTRS <= 6.0.24_community Platform: Linux

Summary

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in OTRS ausnutzen, um Dateien zu manipulieren oder beliebigen Programmcode ausführen.

Product

Das Open Ticket Request System (OTRS) ist ein Ticketsystem für Help-Desks.

Vulnerabilities 3

  • Low 3.5
    CVE-2020-1765

    Spoofing of From field in several screens

    An improper control of parameters allows the spoofing of the from fields of the following screens: AgentTicketCompose, AgentTicketForward, AgentTicketBounce and AgentTicketEmailOutbound. This issue affects: ((OTRS)) Community Edition 5.0.x version 5.0.39 and …

    OTRS OTRS ((OTRS)) Community Edition otrs2 Debian Ubuntu
  • Low 3.5
    CVE-2020-1767

    Possible to send drafted messages as wrong agent

    Agent A is able to save a draft (i.e. for customer reply). Then Agent B can open the draft, change the text completely and send it in the name of Agent A. For the customer it will not be visible that the message was sent by another agent. This issue affects: …

    OTRS OTRS ((OTRS)) Community Edition otrs2 Debian Ubuntu
  • Low 2.0
    CVE-2020-1766

    Improper handling of uploaded inline images

    Due to improper handling of uploaded images it is possible in very unlikely and rare conditions to force the agents browser to execute malicious javascript from a special crafted SVG file rendered as inline jpg file. This issue affects: ((OTRS)) Community Edi…

    OTRS OTRS ((OTRS)) Community Edition otrs2 Debian Ubuntu

Revision history

  1. #3

    Neue Updates von Debian aufgenommen

  2. #2

    Neue Updates von Debian aufgenommen

  3. #1

    Initiale Fassung

References