Summary
Ein Angreifer kann mehrere Schwachstellen in OTRS ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen oder Sicherheitsvorkehrungen zu umgehen.
Product
Das Open Ticket Request System (OTRS) ist ein Ticketsystem für Help-Desks.
Vulnerabilities 2
-
High 8.7
SSL Certificates are not checked for E-Mail Handling
The functions to fetch e-mail via POP3 or IMAP as well as sending e-mail via SMTP use OpenSSL for static SSL or TLS based communication. As the SSL_get_verify_result() function is not used the certificated is trusted always and it can not be ensured that the …
-
Low 3.5
Possible XSS execution in customer information
An attacker who is logged into OTRS as an user with privileges to create and change customer user data may manipulate the CustomerID field to execute JavaScript code that runs immediatly after the data is saved.The issue onlyoccurs if the configuration for Ad…
Revision history
-
#1
Initiale Fassung
References
-
OTRS Security Advisory vom 2023-10-15
https://otrs.com/release-notes/otrs-security-advisory-2023-10/
-
OTRS Security Advisory vom 2023-10-15
https://otrs.com/release-notes/otrs-security-advisory-2023-09/