Filtered by vendor Otrs
Subscribe
Total
133 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2020-1767 | 2 Debian, Otrs | 2 Debian Linux, Otrs | 2023-01-31 | 3.5 LOW | 4.3 MEDIUM |
| Agent A is able to save a draft (i.e. for customer reply). Then Agent B can open the draft, change the text completely and send it in the name of Agent A. For the customer it will not be visible that the message was sent by another agent. This issue affects: ((OTRS)) Community Edition 6.0.x version 6.0.24 and prior versions. OTRS 7.0.x version 7.0.13 and prior versions. | |||||
| CVE-2018-11563 | 2 Debian, Otrs | 2 Debian Linux, Otrs | 2023-01-31 | 4.9 MEDIUM | 4.6 MEDIUM |
| An issue was discovered in Open Ticket Request System (OTRS) 6.0.x through 6.0.7. A carefully constructed email could be used to inject and execute arbitrary stylesheet or JavaScript code in a logged in customer's browser in the context of the OTRS customer panel application. | |||||
| CVE-2019-18180 | 1 Otrs | 1 Otrs | 2023-01-27 | 5.0 MEDIUM | 7.5 HIGH |
| Improper Check for filenames with overly long extensions in PostMaster (sending in email) or uploading files (e.g. attaching files to mails) of ((OTRS)) Community Edition and OTRS allows an remote attacker to cause an endless loop. This issue affects: OTRS AG: ((OTRS)) Community Edition 5.0.x version 5.0.38 and prior versions; 6.0.x version 6.0.23 and prior versions. OTRS AG: OTRS 7.0.x version 7.0.12 and prior versions. | |||||
| CVE-2019-13457 | 1 Otrs | 1 Otrs | 2023-01-27 | 4.0 MEDIUM | 4.3 MEDIUM |
| An issue was discovered in Open Ticket Request System (OTRS) 7.0.x through 7.0.8. A customer user can use the search results to disclose information from their "company" tickets (with the same CustomerID), even when the CustomerDisableCompanyTicketAccess setting is turned on. | |||||
| CVE-2019-16375 | 1 Otrs | 1 Otrs | 2023-01-27 | 3.5 LOW | 5.4 MEDIUM |
| An issue was discovered in Open Ticket Request System (OTRS) 7.0.x through 7.0.11, and Community Edition 5.0.x through 5.0.37 and 6.0.x through 6.0.22. An attacker who is logged in as an agent or customer user with appropriate permissions can create a carefully crafted string containing malicious JavaScript code as an article body. This malicious code is executed when an agent composes an answer to the original article. | |||||
| CVE-2020-1766 | 2 Debian, Otrs | 2 Debian Linux, Otrs | 2023-01-27 | 4.3 MEDIUM | 6.1 MEDIUM |
| Due to improper handling of uploaded images it is possible in very unlikely and rare conditions to force the agents browser to execute malicious javascript from a special crafted SVG file rendered as inline jpg file. This issue affects: ((OTRS)) Community Edition 5.0.x version 5.0.39 and prior versions; 6.0.x version 6.0.24 and prior versions. OTRS 7.0.x version 7.0.13 and prior versions. | |||||
| CVE-2020-1771 | 1 Otrs | 1 Otrs | 2023-01-20 | 3.5 LOW | 5.4 MEDIUM |
| Attacker is able craft an article with a link to the customer address book with malicious content (JavaScript). When agent opens the link, JavaScript code is executed due to the missing parameter encoding. This issue affects: ((OTRS)) Community Edition: 6.0.26 and prior versions. OTRS: 7.0.15 and prior versions. | |||||
| CVE-2019-13458 | 2 Debian, Otrs | 2 Debian Linux, Otrs | 2023-01-20 | 4.0 MEDIUM | 6.5 MEDIUM |
| An issue was discovered in Open Ticket Request System (OTRS) 7.0.x through 7.0.8, and Community Edition 5.0.x through 5.0.36 and 6.0.x through 6.0.19. An attacker who is logged into OTRS as an agent user with appropriate permissions can leverage OTRS notification tags in templates in order to disclose hashed user passwords. | |||||
| CVE-2019-12746 | 2 Debian, Otrs | 2 Debian Linux, Otrs | 2023-01-20 | 4.3 MEDIUM | 6.5 MEDIUM |
| An issue was discovered in Open Ticket Request System (OTRS) Community Edition 5.0.x through 5.0.36 and 6.0.x through 6.0.19. A user logged into OTRS as an agent might unknowingly disclose their session ID by sharing the link of an embedded ticket article with third parties. This identifier can be then be potentially abused in order to impersonate the agent user. | |||||
| CVE-2019-12248 | 2 Debian, Otrs | 2 Debian Linux, Otrs | 2023-01-20 | 4.3 MEDIUM | 4.3 MEDIUM |
| An issue was discovered in Open Ticket Request System (OTRS) 7.0.x through 7.0.7, Community Edition 6.0.x through 6.0.19, and Community Edition 5.0.x through 5.0.36. An attacker could send a malicious email to an OTRS system. If a logged-in agent user quotes it, the email could cause the browser to load external image resources. | |||||
| CVE-2019-12497 | 2 Debian, Otrs | 2 Debian Linux, Otrs | 2023-01-20 | 5.0 MEDIUM | 5.3 MEDIUM |
| An issue was discovered in Open Ticket Request System (OTRS) 7.0.x through 7.0.8, Community Edition 6.0.x through 6.0.19, and Community Edition 5.0.x through 5.0.36. In the customer or external frontend, personal information of agents (e.g., Name and mail address) can be disclosed in external notes. | |||||
| CVE-2019-9892 | 2 Debian, Otrs | 2 Debian Linux, Otrs | 2023-01-20 | 4.0 MEDIUM | 6.5 MEDIUM |
| An issue was discovered in Open Ticket Request System (OTRS) 5.x through 5.0.34, 6.x through 6.0.17, and 7.x through 7.0.6. An attacker who is logged into OTRS as an agent user with appropriate permissions may try to import carefully crafted Report Statistics XML that will result in reading of arbitrary files on the OTRS filesystem. | |||||
| CVE-2019-10067 | 1 Otrs | 1 Otrs | 2023-01-20 | 3.5 LOW | 5.4 MEDIUM |
| An issue was discovered in Open Ticket Request System (OTRS) 7.x through 7.0.6 and Community Edition 5.0.x through 5.0.35 and 6.0.x through 6.0.17. An attacker who is logged into OTRS as an agent user with appropriate permissions may manipulate the URL to cause execution of JavaScript in the context of OTRS. | |||||
| CVE-2022-4427 | 1 Otrs | 1 Otrs | 2022-12-28 | N/A | 9.8 CRITICAL |
| Improper Input Validation vulnerability in OTRS AG OTRS, OTRS AG ((OTRS)) Community Edition allows SQL Injection via TicketSearch Webservice This issue affects OTRS: from 7.0.1 before 7.0.40 Patch 1, from 8.0.1 before 8.0.28 Patch 1; ((OTRS)) Community Edition: from 6.0.1 through 6.0.34. | |||||
| CVE-2021-36097 | 1 Otrs | 1 Otrs | 2022-10-27 | 4.0 MEDIUM | 4.3 MEDIUM |
| Agents are able to lock the ticket without the "Owner" permission. Once the ticket is locked, it could be moved to the queue where the agent has "rw" permissions and gain a full control. This issue affects: OTRS AG OTRS 8.0.x version: 8.0.16 and prior versions. | |||||
| CVE-2021-21437 | 1 Otrs | 2 Itsmconfigurationmanagement, Otrscisincustomerfrontend | 2022-10-24 | 4.0 MEDIUM | 4.3 MEDIUM |
| Agents are able to see linked Config Items without permissions, which are defined in General Catalog. This issue affects: OTRSCIsInCustomerFrontend 7.0.15 and prior versions, ITSMConfigurationManagement 7.0.24 and prior versions | |||||
| CVE-2022-39052 | 1 Otrs | 1 Otrs | 2022-10-20 | N/A | 6.5 MEDIUM |
| An external attacker is able to send a specially crafted email (with many recipients) and trigger a potential DoS of the system | |||||
| CVE-2022-3501 | 1 Otrs | 1 Otrs | 2022-10-20 | N/A | 7.5 HIGH |
| Article template contents with sensitive data could be accessed from agents without permissions. | |||||
| CVE-2022-39051 | 1 Otrs | 1 Otrs | 2022-09-30 | N/A | 8.8 HIGH |
| Attacker might be able to execute malicious Perl code in the Template toolkit, by having the admin installing an unverified 3th party package | |||||
| CVE-2022-39050 | 1 Otrs | 1 Otrs | 2022-09-08 | N/A | 4.8 MEDIUM |
| An attacker who is logged into OTRS as an admin user may manipulate customer URL field to store JavaScript code to be run later by any other agent when clicking the customer URL link. Then the stored JavaScript is executed in the context of OTRS. The same issue applies for the usage of external data sources e.g. database or ldap | |||||