OTRS GmbH (former OTRS AG)

The HTTP Basic Authentication modules in ((OTRS)) Community Edition 6 and prior accept the authenticated username from either the REMOTE_USER or HTTP_REMOTE_USER environment variable.

Previously issued authentication tokens are not immediately invalidated when an OTRS agent or customer user account is deactivated or its password is changed.

A path traversal vulnerability in the OTRS SendSupportBundle functionality allows an authenticated administrator to reference file paths outside the intended directory.

The OTRS Agent Frontend configuration endpoint can be accessed without authentication.

User-controlled values are not sufficiently neutralized when included in CSV exports.

OTRS does not sufficiently enforce the uniqueness of customer user identities across multiple configured CustomerUser backends.

An authenticated administrator can be induced to delete administrative Import/Export templates through a Cross-Site Request Forgery (CSRF) attack.

An OTRS administrator can enter arbitrary JavaScript into the content of an OTRS Custom Page, which is stored by the application and subsequently executed in the browser of users accessing that page.

Several administrative actions do not sufficiently validate whether a request was intentionally initiated by the authenticated user.