Skip to content
OpenAdvisories
Medium WID-SEC-2024-0234 4 CVEs

OTRS: Mehrere Schwachstellen

Published Jan 28, 2024 · Updated Jan 28, 2024 · de-DE

Vendor: OTRS Product: OTRS Product: OTRS 2023.x < LTS 7.0.49 Product: OTRS 2023.x < Patch 2024.1.1 Product: OTRS 8.x < Patch 2024.1.1 Platform: Linux Platform: Windows

Summary

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in OTRS ausnutzen, um Informationen offenzulegen, Sicherheitsmaßnahmen zu umgehen oder einen Cross Site Scripting Angriff durchzuführen.

Product

Das Open Ticket Request System (OTRS) ist ein Ticketsystem für Help-Desks.

Vulnerabilities 4

  • Medium 6.1
    CVE-2021-33829 Scanner template

    ckeditor4 vulnerable to cross-site scripting

    A cross-site scripting (XSS) vulnerability in the HTML Data Processor in CKEditor 4 4.14.0 through 4.16.x before 4.16.1 allows remote attackers to inject executable JavaScript code through a crafted comment because --!> is mishandled.

    drupal/core drupal/drupal ckeditor ckeditor Debian Ubuntu npm Packagist
  • Medium 5.3
    CVE-2024-23792

    Insufficient access control

    When adding attachments to ticket comments, another user can add attachments as well impersonating the orginal user. The attack requires a logged-in other user to know the UUID. While the legitimate user completes the comment, the malicious user can add more …

    OTRS OTRS otrs2 znuny Ubuntu
  • Medium 4.9
    CVE-2024-23791

    Unnecessary data is written to log if issues during indexing occurs

    Insertion of debug information into log file during building the elastic search index allows reading of sensitive information from articles.This issue affects OTRS: from 7.0.X through 7.0.48, from 8.0.X through 8.0.37, from 2023.X through 2023.1.1.

    OTRS OTRS otrs2 znuny Ubuntu
  • Low 3.5
    CVE-2024-23790

    Missing file type check in avatar picture upload

    Improper Input Validation vulnerability in the upload functionality for user avatars allows functionality misuse due to missing check of filetypes. This issue affects OTRS: from 7.0.X through 7.0.48, from 8.0.X through 8.0.37, from 2023 through 2023.1.1.

    OTRS OTRS otrs2 znuny Ubuntu

Revision history

  1. #1

    Initiale Fassung

References