OT
Product
Otrs
142
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 4High 23Medium 68Low 2
Watch
Add Otrs to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2023-5421 | 5.5 | Oct 16 | An attacker who is logged into OTRS as an user with privileges to create and change customer user data may manipulate the CustomerID field to execute JavaScript code that runs … Affected: 6.0.0 through 6.0.34; 7.0.0 before 7.0.47; 8.0.0 before 8.0.37 |
| CVE-2022-0475 | 5.4 | Mar 21 | Malicious translator is able to inject JavaScript code in few translatable strings (where HTML is allowed) Affected: 7.0.0 through 7.0.32; 8.0.0 through 8.0.19 |
| CVE-2021-36094 | 5.4 | Sep 6 | It's possible to craft a request for appointment edit screen, which could lead to the XSS attack Affected: 6.0.1 and later; 7.0.0 before 7.0.29 |
| CVE-2013-4718 | 5.4 | Aug 9 | Cross-site scripting (XSS) vulnerability in Open Ticket Request System (OTRS) ITSM 3.0.x before 3.0.9, 3.1.x before 3.1.10, and 3.2.x before 3.2.7 allows remote authenticated… Affected: 3.0.0 through 3.0.21; 3.1.0 through 3.1.17; 3.2.0 through 3.2.8 |
| CVE-2020-1771 | 5.4 | Mar 27 | Attacker is able craft an article with a link to the customer address book with malicious content (JavaScript) Affected: 5.0.0 through 5.0.41; 6.0.0 through 6.0.26; 7.0.0 through 7.0.15 |
| CVE-2019-16375 | 5.4 | Mar 19 | An issue was discovered in Open Ticket Request System (OTRS) 7.0.x through 7.0.11, and Community Edition 5.0.x through 5.0.37 and 6.0.x through 6.0.22 Affected: 5.0.0 through 5.0.37; 6.0.0 through 6.0.22; 7.0.0 through 7.0.11 |
| CVE-2020-1768 | 5.4 | Feb 7 | The external frontend system uses numerous background calls to the backend Affected: 7.0.0 through 7.0.14 |
| CVE-2019-10067 | 5.4 | May 22 | An issue was discovered in Open Ticket Request System (OTRS) 7.x through 7.0.6 and Community Edition 5.0.x through 5.0.35 and 6.0.x through 6.0.17 Affected: 5.0.0 through 5.0.35; 6.0.0 through 6.0.17; 7.0.0 through 7.0.6 |
| CVE-2019-10066 | 5.4 | May 22 | An issue was discovered in Open Ticket Request System (OTRS) 7.x through 7.0.6, Community Edition 6.0.x through 6.0.17, and OTRSAppointmentCalendar 5.0.x through 5.0.12 Affected: 5.0.0 through 5.0.12; 6.0.0 through 6.0.17; 7.0.0 through 7.0.6 |
| CVE-2019-9752 | 5.4 | Mar 13 | An issue was discovered in Open Ticket Request System (OTRS) 5.x before 5.0.34, 6.x before 6.0.16, and 7.x before 7.0.4 Affected: 5.0.0 before 5.0.34; 6.0.0 before 6.0.16; 7.0.0 before 7.0.4 |
| CVE-2024-6540 | 5.3 | Jul 15 | Improper filtering of fields when using the export function in the ticket overview of the external interface in OTRS could allow an authorized user to download a list of tickets… Affected: 8.0.0 before 2024.5.2 |
| CVE-2023-38059 | 5.3 | Oct 16 | The loading of external images is not blocked, even if configured, if the attacker uses protocol-relative URL in the payload Affected: 6.0.0 through 6.0.34; 7.0.0 before 7.0.47; 8.0.0 before 8.0.37 |
| CVE-2022-32741 | 5.3 | Jun 13 | Attacker is able to determine if the provided username exists (and it's valid) using Request New Password feature, based on the response time Affected: 7.0.0 before 7.0.35; 8.0.0 before 8.0.23 |
| CVE-2022-32740 | 5.3 | Jun 13 | A reply to a forwarded email article by a 3rd party could unintensionally expose the email content to the ticket customer under certain circumstances Affected: 7.0.0 before 7.0.35; 8.0.0 before 8.0.23 |
| CVE-2022-32739 | 5.3 | Jun 13 | When Secure::DisableBanner system configuration has been disabled and agent shares his calendar via public URL, received ICS file contains OTRS release number Affected: 7.0.0 before 7.0.35; 8.0.0 before 8.0.23 |
| CVE-2021-36095 | 5.3 | Sep 6 | Malicious attacker is able to find out valid user logins by using the "lost password" feature Affected: 6.0.1 and later; 7.0.0 before 7.0.29 |
| CVE-2021-36093 | 5.3 | Sep 6 | It's possible to create an email which can be stuck while being processed by PostMaster filters, causing DoS Affected: 6.0.1 and later; 7.0.0 before 7.0.29; 8.0.0 before 8.0.16 |
| CVE-2020-1777 | 5.3 | Oct 15 | Agent names that participates in a chat conversation are revealed in certain parts of the external interface as well as in chat transcriptions inside the tickets, when system is… Affected: 7.0.0 through 7.0.21; 8.0.0 through 8.0.6 |
| CVE-2020-1765 | 5.3 | Jan 10 | An improper control of parameters allows the spoofing of the from fields of the following screens: AgentTicketCompose, AgentTicketForward, AgentTicketBounce and… Affected: 5.0.0 through 5.0.39; 6.0.0 through 6.0.24; 7.0.0 through 7.0.13 |
| CVE-2019-12497 | 5.3 | Jun 17 | An issue was discovered in Open Ticket Request System (OTRS) 7.0.x through 7.0.8, Community Edition 6.0.x through 6.0.19, and Community Edition 5.0.x through 5.0.36 Affected: 5.0.0 through 5.0.36; 6.0.0 through 6.0.19; 7.0.0 through 7.0.8 |
| CVE-2021-36096 | 4.9 | Sep 6 | Generated Support Bundles contains private S/MIME and PGP keys if containing folder is not hidden Affected: 6.0.1 and later; 7.0.0 before 7.0.29; 8.0.0 before 8.0.16 |
| CVE-2020-1774 | 4.9 | Apr 28 | When user downloads PGP or S/MIME keys/certificates, exported file has same name for private and public keys Affected: 5.0.0 through 5.0.42; 6.0.0 through 6.0.27; 7.0.0 through 7.0.16 |
| CVE-2022-39050 | 4.8 | Sep 5 | An attacker who is logged into OTRS as an admin user may manipulate customer URL field to store JavaScript code to be run later by any other agent when clicking the customer URL… Affected: 6.0.0 through 6.0.32; 7.0.0 before 7.0.37; 8.0.0 before 8.0.25 |
| CVE-2022-39049 | 4.8 | Sep 5 | An attacker who is logged into OTRS as an admin user may manipulate the URL to cause execution of JavaScript in the context of OTRS Affected: 6.0.0 through 6.0.32; 7.0.0 before 7.0.37; 8.0.0 before 8.0.25 |
| CVE-2022-0473 | 4.8 | Feb 7 | OTRS administrators can configure dynamic field and inject malicious JavaScript code in the error message of the regular expression check Affected: 7.0.0 before 7.0.32 |
| CVE-2019-9751 | 4.8 | Mar 13 | An issue was discovered in Open Ticket Request System (OTRS) 6.x before 6.0.17 and 7.x before 7.0.5 Affected: 6.0.0 before 6.0.17; 7.0.0 before 7.0.5 |
| CVE-2018-11563 | 4.6 | Jul 8 | An issue was discovered in Open Ticket Request System (OTRS) 6.0.x through 6.0.7 Affected: 6.0.0 through 6.0.7 |
| CVE-2023-38058 | 4.3 | Jul 24 | An improper privilege check in the OTRS ticket move action in the agent interface allows any as agent authenticated attacker to to perform a move of an ticket without the… Affected: 8.0.0 before 8.0.35 |
| CVE-2022-1004 | 4.3 | Mar 21 | Accounted time is shown in the Ticket Detail View (External Interface), even if ExternalFrontend::TicketDetailView###AccountedTimeDisplay is disabled Affected: 7.0.0 before 7.0.33; 8.0.0 before 8.0.20 |
| CVE-2021-36097 | 4.3 | Oct 18 | Agents are able to lock the ticket without the "Owner" permission Affected: 8.0.0 through 8.0.16 |
| CVE-2021-36091 | 4.3 | Jul 26 | Agents are able to list appointments in the calendars without required permissions Affected: 6.0.0 before 6.0.32; 7.0.0 before 7.0.28 |
| CVE-2021-21443 | 4.3 | Jul 26 | Agents are able to list customer user emails without required permissions in the bulk action screen Affected: 6.0.0 through 6.0.32; 7.0.0 through 7.0.27 |
| CVE-2021-21438 | 4.3 | Mar 22 | Agents are able to see linked FAQ articles without permissions (defined in FAQ Category) Affected: 7.0.0 before 7.0.24 |
| CVE-2020-1778 | 4.3 | Nov 23 | When OTRS uses multiple backends for user authentication (with LDAP), agents are able to login even if the account is set to invalid Affected: through 8.0.9 |
| CVE-2020-1776 | 4.3 | Jul 20 | When an agent user is renamed or set to invalid the session belonging to the user is keept active Affected: before 6.0.29; 7.0.0 before 7.0.19; 8.0.1 before 8.0.5 |
| CVE-2020-1775 | 4.3 | Jun 8 | BCC recipients in mails sent from OTRS are visible in article detail on external interface Affected: 7.0.0 before 7.0.18; 8.0.0 before 8.0.3 |
| CVE-2020-1770 | 4.3 | Mar 27 | Support bundle generated files could contain sensitive information that might be unwanted to be disclosed Affected: 5.0.0 through 5.0.41; 6.0.0 through 6.0.26; 7.0.0 through 7.0.15 |
| CVE-2020-1769 | 4.3 | Mar 27 | In the login screens (in agent and customer interface), Username and Password fields use autocomplete, which might be considered as security issue Affected: 5.0.0 through 5.0.41; 6.0.0 through 6.0.26; 7.0.0 through 7.0.15 |
| CVE-2019-13457 | 4.3 | Mar 10 | An issue was discovered in Open Ticket Request System (OTRS) 7.0.x through 7.0.8 Affected: 7.0.0 through 7.0.8 |
| CVE-2019-10065 | 4.3 | Mar 10 | An issue was discovered in Open Ticket Request System (OTRS) 7.0 through 7.0.6 Affected: 7.0.0 through 7.0.6 |
| CVE-2020-1767 | 4.3 | Jan 10 | Agent A is able to save a draft (i.e Affected: 6.0.0 through 6.0.24; 7.0.0 through 7.0.13 |
| CVE-2019-18179 | 4.3 | Jan 6 | An issue was discovered in Open Ticket Request System (OTRS) 7.0.x through 7.0.12, and Community Edition 5.0.x through 5.0.38 and 6.0.x through 6.0.23 Affected: 5.0.0 through 5.0.38; 6.0.0 through 6.0.23; 7.0.0 through 7.0.12 |
| CVE-2019-12248 | 4.3 | Jun 17 | An issue was discovered in Open Ticket Request System (OTRS) 7.0.x through 7.0.7, Community Edition 6.0.x through 6.0.19, and Community Edition 5.0.x through 5.0.36 Affected: 5.0.0 through 5.0.36; 6.0.0 through 6.0.19; 7.0.0 through 7.0.7 |
| CVE-2019-9753 | 4.3 | Jun 3 | An issue was discovered in Open Ticket Request System (OTRS) 7.x before 7.0.5 Affected: 7.0.0 before 7.0.5 |
| CVE-2018-10198 | 4.3 | Jun 6 | An issue was discovered in OTRS 6.0.x before 6.0.7 Affected: 6.0.0 before 6.0.7 |
| CVE-2026-48190 | 3.5 | Jun 1 | Incorrect handling of permissions in External Interface Config Item List module Affected: 7.0.0 through 8.0.37; 2023.0.0 before 2026.4.1 |
| CVE-2026-48191 | 3.5 | Jun 1 | Wrong Permission Handling in Document Search Article Meta Filters Affected: 7.0.0 through 8.0.37; 2023.0.0 before 2026.4.1 |
| CVE-2014-2554 | – | Apr 23 | OTRS 3.1.x before 3.1.21, 3.2.x before 3.2.16, and 3.3.x before 3.3.6 allows remote attackers to conduct clickjacking attacks via an IFRAME element Affected: 3.1.0; 3.1.1; 3.1.2; 3.1.3; 3.1.4; 3.1.5; +34 more |
| CVE-2014-2553 | – | Apr 2 | Cross-site scripting (XSS) vulnerability in Open Ticket Request System (OTRS) 3.1.x before 3.1.21, 3.2.x before 3.2.16, and 3.3.x before 3.3.6 allows remote authenticated users to… Affected: 3.2.0; 3.2.0; 3.2.0; 3.2.0; 3.2.0; 3.2.0; +34 more |
| CVE-2014-1695 | – | Mar 1 | Cross-site scripting (XSS) vulnerability in Open Ticket Request System (OTRS) 3.1.x before 3.1.20, 3.2.x before 3.2.15, and 3.3.x before 3.3.5 allows remote attackers to inject… Affected: 3.3.0; 3.3.0; 3.3.0; 3.3.0; 3.3.0; 3.3.0; +34 more |