Vulnerabilities

TI-2023-04990 CVE-2023-5421 · GHSA-hqj4-p6qw-7mf2

Possible XSS execution in customer information

LOW 25

An attacker who is logged into OTRS as an user with privileges to create and change customer user data may manipulate the CustomerID field to execute JavaScript code that runs immediatly after the data is saved.The issue…

CVSS 3.1MEDIUM 5.5 Network High privileges No interaction EPSS 0.00445 Published 2023-10-16 Fixed in 7.0.47, 8.0.37 CWE-20

TI-2023-19483 CVE-2023-38059 · GHSA-6gr4-x7gv-xwjp

External pictures can be loaded even if not allowed by configuration

LOW 25

The loading of external images is not blocked, even if configured, if the attacker uses protocol-relative URL in the payload.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00549 Published 2023-10-16 Fixed in 7.0.47, 8.0.37 CWE-200

TI-2023-04991 CVE-2023-5422 · GHSA-qxp6-m9jg-58rw

SSL Certificates are not checked for E-Mail Handling

MEDIUM 47

The functions to fetch e-mail via POP3 or IMAP as well as sending e-mail via SMTP use OpenSSL for static SSL or TLS based communication.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00329 Published 2023-10-16 Fixed in 7.0.47, 8.0.37 CWE-295

Vulnerabilities

Filters

Possible XSS execution in customer information

External pictures can be loaded even if not allowed by configuration

SSL Certificates are not checked for E-Mail Handling