Summary
Ein Angreifer kann mehrere Schwachstellen in OTRS ausnutzen, um seine Privilegien zu erhöhen, die Authentifizierung zu umgehen, vertrauliche Informationen offenzulegen, Daten zu manipulieren und Cross-Site-Scripting-Angriffe durchzuführen.
Product
Das Open Ticket Request System (OTRS) ist ein Ticketsystem für Help-Desks.
Vulnerabilities 9
-
Critical 9.4
Authentication Bypass via Spoofed Remote-User Header in HTTP Basic Authentication
The HTTP Basic Authentication modules in ((OTRS)) Community Edition 6 and prior accept the authenticated username from either the REMOTE_USER or HTTP_REMOTE_USER environment variable. In CGI and mod_perl based deployments, HTTP request headers may be mapped t…
-
Critical 9.1
Insufficient Session Revocation for JWT Authentication
Previously issued authentication tokens are not immediately invalidated when an OTRS agent or customer user account is deactivated or its password is changed. As a result, an existing JWT may remain valid until its regular expiration time, which can be approx…
-
High 8.7
Path Traversal in SendSupportBundle allows File Deletion Outside the Intended Directory
A path traversal vulnerability in the OTRS SendSupportBundle functionality allows an authenticated administrator to reference file paths outside the intended directory. This may allow files accessible to the OTRS application process to be deleted. The vulnera…
-
Medium 6.1
Insufficient Neutralization of Formula Elements in CSV Exports
User-controlled values are not sufficiently neutralized when included in CSV exports. Values originating from user input, including data submitted by authenticated users or received through external communication channels such as email, may be stored in field…
-
Medium 5.4
Cross-Site Request Forgery in Import/Export Admin console
An authenticated administrator can be induced to delete administrative Import/Export templates through a Cross-Site Request Forgery (CSRF) attack. The OTRS AdminImportExport::TemplateDelete action does not validate the request's ChallengeToken, allowing an un…
-
Medium 5.4
Duplicate Identity / Identity Shadowing across CustomerUser backends
OTRS does not sufficiently enforce the uniqueness of customer user identities across multiple configured CustomerUser backends. When multiple backends, such as a database and LDAP, are configured, the uniqueness check for customer user email addresses is perf…
-
Medium 5.3
Unauthenticated Disclosure of Agent Frontend Configuration
The OTRS Agent Frontend configuration endpoint can be accessed without authentication. This allows unauthenticated remote users to retrieve internal application configuration that is intended for use by the authenticated Agent Frontend. The exposed informatio…
-
Medium 4.8
Stored XSS in external pages
An OTRS administrator can enter arbitrary JavaScript into the content of an OTRS Custom Page, which is stored by the application and subsequently executed in the browser of users accessing that page. This issue affects OTRS: * 7.0.X * 8.0.X * 2023.X * 2024.X …
-
Medium 4.3
Cross-Site Request Forgery in Administrative Actions
Several administrative actions do not sufficiently validate whether a request was intentionally initiated by the authenticated user. In particular, the DBUpdateLogCleanUp action can be triggered through a GET request without validating a ChallengeToken. An un…
Revision history
-
#1
Initiale Fassung
References
-
OTRS Security Advisory vom 2026-10-11
https://otrs.com/release-notes/otrs-security-advisory-2026-11/
-
OTRS Security Advisory vom 2026-10-11
https://otrs.com/release-notes/otrs-security-advisory-2026-12/
-
OTRS Security Advisory vom 2026-10-11
https://otrs.com/release-notes/otrs-security-advisory-2026-13/
-
OTRS Security Advisory vom 2026-10-11
https://otrs.com/release-notes/otrs-security-advisory-2026-14/
-
OTRS Security Advisory vom 2026-10-11
https://otrs.com/release-notes/otrs-security-advisory-2026-15/
-
OTRS Security Advisory vom 2026-10-11
https://otrs.com/release-notes/otrs-security-advisory-2026-16/
-
OTRS Security Advisory vom 2026-10-11
https://otrs.com/release-notes/otrs-security-advisory-2026-17/
-
OTRS Security Advisory vom 2026-10-11
https://otrs.com/release-notes/otrs-security-advisory-2026-18/