Skip to content
OpenAdvisories
Medium WID-SEC-2025-0193 5 CVEs

OTRS: Mehrere Schwachstellen

Published Jan 26, 2025 · Updated Nov 3, 2025 · Revision 2 · de-DE

Vendor: OTRS Product: OTRS Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in OTRS ausnutzen, um Daten zu manipulieren, vertrauliche Informationen preiszugeben, Sicherheitsmaßnahmen zu umgehen und sich unbefugten Zugang zu verschaffen.

Product

Das Open Ticket Request System (OTRS) ist ein Ticketsystem für Help-Desks.

Vulnerabilities 5

  • Medium 6.8
    CVE-2025-24390

    Missing Cookie Flags

    A vulnerability in OTRS Application Server and reverse proxy settings allows session hijacking due to missing attributes for sensitive cookie settings in HTTPS sessions. This issue affects: * OTRS 7.0.X * OTRS 8.0.X * OTRS 2023.X * OTRS 2024.X

    OTRS OTRS
  • Medium 6.3
    CVE-2025-24389

    SMTP Password will be shown in cleartext on some SMTP errors

    Certain errors of the upstream libraries will insert sensitive information in the OTRS or ((OTRS)) Community Edition log mechanism and mails send to the system administrator. This issue affects: * OTRS 7.0.X * OTRS 8.0.X * OTRS 2023.X * OTRS 2024.X * ((OTRS))…

    OTRS OTRS ((OTRS)) Community Edition
  • Medium 5.5
    CVE-2025-43446

    This issue was addressed with improved validation of symlinks. This issue is fixed in macOS Sequoia 15.7.2, macOS Sonom…

    Apple macOS macOS
  • Medium 5.4
    CVE-2024-43445

    Missing X-Content-Type-Options: nosniff Header Allows MIME Type Sniffing

    A vulnerability exists in OTRS and ((OTRS Community Edition)) that fail to set the HTTP response header X-Content-Type-Options to nosniff. An attacker could exploit this vulnerability by uploading or inserting content that would be treated as a different MIME…

    OTRS OTRS ((OTRS)) Community Edition
  • Medium 4.8
    CVE-2025-24387

    Missing CSRF protection

    A vulnerability in OTRS Application Server allows session hijacking due to missing attributes for sensitive cookie settings in HTTPS sessions. A request to an OTRS endpoint from a possible malicious web site, would send the authentication cookie, performing a…

    OTRS OTRS

Revision history

  1. #2

    Referenz(en) aufgenommen: EUVD-2025-37665

  2. #1

    Initiale Fassung

References