Denial-of-Service via SVG Rendering in Ticket

Missing CSRF protection

When adding attachments to ticket comments, another user can add attachments as well impersonating the orginal user

DoS attack using email

Generated Support Bundles contains private S/MIME and PGP keys if containing folder is not hidden

DoS attack can be performed when an email contains specially designed URL in the body

Article Bcc fields and agent personal information are shown when customer prints the ticket (PDF) via external interface

Kernel/Modules/AgentTicketWatcher.pm in Open Ticket Request System (OTRS) 3.0.x before 3.0.21, 3.1.x before 3.1.17, and 3.2.x before 3.2.8 does not properly restrict tickets,…

Kernel/Modules/AgentTicketPhone.pm in Open Ticket Request System (OTRS) 3.0.x before 3.0.20, 3.1.x before 3.1.16, and 3.2.x before 3.2.7, and OTRS ITSM 3.0.x before 3.0.8, 3.1.x…

An issue was discovered in Open Ticket Request System (OTRS) 7.0.x through 7.0.8, and Community Edition 5.0.x through 5.0.36 and 6.0.x through 6.0.19

An issue was discovered in Open Ticket Request System (OTRS) Community Edition 5.0.x through 5.0.36 and 6.0.x through 6.0.19

An issue was discovered in Open Ticket Request System (OTRS) 5.x through 5.0.34, 6.x through 6.0.17, and 7.x through 7.0.6

An issue was discovered in Open Ticket Request System (OTRS) 5.0.31 and 6.0.13

In Open Ticket Request System (OTRS) through 3.3.20, 4 through 4.0.26, 5 through 5.0.24, and 6 through 6.0.1, an attacker who is logged in as a customer can use the ticket search…

Upload of files outside application directory

An issue was discovered in Open Ticket Request System (OTRS) 6.0.x before 6.0.12

Improper Input Validation vulnerability in OTRS AG OTRS (Ticket Actions modules), OTRS AG ((OTRS)) Community Edition (Ticket Actions modules) allows Cross-Site Scripting…

It's possible to create an email which contains specially crafted link and it can be used to perform XSS attack

Due to improper handling of uploaded images it is possible in very unlikely and rare conditions to force the agents browser to execute malicious javascript from a special crafted…

Open Ticket Request System (OTRS) 3.3.9 has XSS in index.pl?Action=AgentStats requests, as demonstrated by OrderBy=[XSS] and Direction=[XSS] attacks

Cross-site scripting (XSS) vulnerability in Open Ticket Request System (OTRS) 3.3.x before 3.3.16, 4.0.x before 4.0.19, and 5.0.x before 5.0.14 allows remote attackers to inject…

Email with special content can lead to DoS

Bypass DedicatedAgentToCustomerGroups Setting

Possible information disclosure via External Interface

An attacker who is logged into OTRS as an user with privileges to create and change customer user data may manipulate the CustomerID field to execute JavaScript code that runs …

Malicious translator is able to inject JavaScript code in few translatable strings (where HTML is allowed)

It's possible to craft a request for appointment edit screen, which could lead to the XSS attack

Cross-site scripting (XSS) vulnerability in Open Ticket Request System (OTRS) ITSM 3.0.x before 3.0.9, 3.1.x before 3.1.10, and 3.2.x before 3.2.7 allows remote authenticated…

Attacker is able craft an article with a link to the customer address book with malicious content (JavaScript)

An issue was discovered in Open Ticket Request System (OTRS) 7.0.x through 7.0.11, and Community Edition 5.0.x through 5.0.37 and 6.0.x through 6.0.22

The external frontend system uses numerous background calls to the backend

An issue was discovered in Open Ticket Request System (OTRS) 7.x through 7.0.6 and Community Edition 5.0.x through 5.0.35 and 6.0.x through 6.0.17

An issue was discovered in Open Ticket Request System (OTRS) 7.x through 7.0.6, Community Edition 6.0.x through 6.0.17, and OTRSAppointmentCalendar 5.0.x through 5.0.12

An issue was discovered in Open Ticket Request System (OTRS) 5.x before 5.0.34, 6.x before 6.0.16, and 7.x before 7.0.4

Information exlosure in external interface

The loading of external images is not blocked, even if configured, if the attacker uses protocol-relative URL in the payload

Attacker is able to determine if the provided username exists (and it's valid) using Request New Password feature, based on the response time

A reply to a forwarded email article by a 3rd party could unintensionally expose the email content to the ticket customer under certain circumstances

When Secure::DisableBanner system configuration has been disabled and agent shares his calendar via public URL, received ICS file contains OTRS release number

Malicious attacker is able to find out valid user logins by using the "lost password" feature

It's possible to create an email which can be stuck while being processed by PostMaster filters, causing DoS

Agent names that participates in a chat conversation are revealed in certain parts of the external interface as well as in chat transcriptions inside the tickets, when system is…

An improper control of parameters allows the spoofing of the from fields of the following screens: AgentTicketCompose, AgentTicketForward, AgentTicketBounce and…

An issue was discovered in Open Ticket Request System (OTRS) 7.0.x through 7.0.8, Community Edition 6.0.x through 6.0.19, and Community Edition 5.0.x through 5.0.36

Generated Support Bundles contains private S/MIME and PGP keys if containing folder is not hidden

When user downloads PGP or S/MIME keys/certificates, exported file has same name for private and public keys

An attacker who is logged into OTRS as an admin user may manipulate customer URL field to store JavaScript code to be run later by any other agent when clicking the customer URL…

An attacker who is logged into OTRS as an admin user may manipulate the URL to cause execution of JavaScript in the context of OTRS

OTRS administrators can configure dynamic field and inject malicious JavaScript code in the error message of the regular expression check

An issue was discovered in Open Ticket Request System (OTRS) 6.x before 6.0.17 and 7.x before 7.0.5