Skip to content
OpenAdvisories

Vendor

OTRS

81 known vulnerabilities.

Products

OTRS 75 ((OTRS)) Community Edition 46 OTRSCIsInCustomerFrontend 2 OTRSTicketForms 1 SystemMonitoring 1 OTRSSTORM 1 Survey 1 FAQ 1 ITSMConfigurationManagement 1 Time Accounting 1 OTRSCustomContactFields 1 OTRSCalendarResourcePlanning 1 OTRS <= 7.0.7 0 OTRS <= 6.0.19 0 OTRS <= 5.0.36 0 OTRS < 5.0.37 0 OTRS < 6.0.20 0 OTRS < 7.0.9 0 OTRS < 6.0.21 (Business) 0 OTRS < 7.0.12 0 OTRS 8.x < Patch 2024.1.1 0 OTRS < 6.0.23 0 OTRS 2023.x < Patch 2024.1.1 0 OTRS < 5.0.38 0 OTRS 2023.x < LTS 7.0.49 0 OTRS < 7.0.13 0 OTRS < 6.0.24 0 OTRS < 5.0.39 0 OTRS < 7.0.14 0 OTRS <= 6.0.24_community 0 OTRS <= 5.0.39_community 0 OTRS < 7.0.16 0 OTRS < 6.0.27_Community 0 OTRS < 5.0.42_Community 0 OTRS < 7.0.17 0 OTRS < 6.0.28 Community 0 OTRS < 5.0.43 Community 0 OTRS < 8.0.5 0 OTRS < 7.0.19 0 OTRS < 6.0.29 community 0
All Critical High Medium Low Exploited only Public exploit

44 results · Clear filters · Feed

  • Medium 4.5
    CVE-2020-1774

    Information disclosure

    When user downloads PGP or S/MIME keys/certificates, exported file has same name for private and public keys. Therefore it's possible to mix them and to send private key to the third-party instead of public key. This issue affects ((OTRS)) Community Edition: …

    OTRS OTRS ((OTRS)) Community Edition otrs2 Debian Ubuntu
  • Medium 4.6
    CVE-2020-1771

    Possible XSS in Customer user address book

    Attacker is able craft an article with a link to the customer address book with malicious content (JavaScript). When agent opens the link, JavaScript code is executed due to the missing parameter encoding. This issue affects: ((OTRS)) Community Edition: 6.0.2…

    OTRS OTRS ((OTRS)) Community Edition otrs2 Debian Ubuntu
  • Medium 6.5
    CVE-2020-1772

    Information Disclosure

    It's possible to craft Lost Password requests with wildcards in the Token value, which allows attacker to retrieve valid Token(s), generated by users which already requested new passwords. This issue affects: ((OTRS)) Community Edition 5.0.41 and prior versio…

    OTRS OTRS ((OTRS)) Community Edition otrs2 Debian Ubuntu
  • Medium 5.4
    CVE-2020-1768

    External Interface does not invalidate session

    The external frontend system uses numerous background calls to the backend. Each background request is treated as user activity so the SessionMaxIdleTime will not be reached. This issue affects: OTRS 7.0.x version 7.0.14 and prior versions.

    OTRS OTRS otrs2 Ubuntu