Medium severity · published Jan 27, 2025
CVE-2025-24389
SMTP Password will be shown in cleartext on some SMTP errors
6.3
CVSS
0.1%
EPSS
No
On KEV
Description
Certain errors of the upstream libraries will insert sensitive information in the OTRS or ((OTRS)) Community Edition log mechanism and mails send to the system administrator.
This issue affects:
* OTRS 7.0.X
* OTRS 8.0.X
* OTRS 2023.X
* OTRS 2024.X
* ((OTRS)) Community Edition: 6.0.x
Products based on the ((OTRS)) Community Edition also very likely to be affected
CVSS vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
Attack vector
Local
Complexity
High
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 3% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OC
((OTRS)) Community Edition · OTRS AG
6.0.x through 6.0.34 · source: vendor
OT
OTRS · OTRS AG
7.0.x; 8.0.x; 2023.x; 2024.x · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-24389
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-24389
otrs.com
https://otrs.com/release-notes/otrs-security-advisory-2025-03/
More from ((OTRS)) Community Edition
9.1
CVE-2026-48188
SQL Injection via MySQL Quote Method
9.1
CVE-2023-5422
SSL Certificates are not checked for E-Mail Handling
8.8
CVE-2023-38060
Host header injection by attachments in web service
8.2
CVE-2024-43444
Passwords are written to Admin Log Module
7.2
CVE-2023-38056
Code execution via System Configuration