OT
Product
Otrs
143
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 4High 24Medium 68Low 2
Watch
Add Otrs to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2023-38058 | 4.3 | Jul 24 | An improper privilege check in the OTRS ticket move action in the agent interface allows any as agent authenticated attacker to to perform a move of an ticket without the… Affected: 8.0.0 before 8.0.35 |
| CVE-2022-1004 | 4.3 | Mar 21 | Accounted time is shown in the Ticket Detail View (External Interface), even if ExternalFrontend::TicketDetailView###AccountedTimeDisplay is disabled Affected: 7.0.0 before 7.0.33; 8.0.0 before 8.0.20 |
| CVE-2021-36097 | 4.3 | Oct 18 | Agents are able to lock the ticket without the "Owner" permission Affected: 8.0.0 through 8.0.16 |
| CVE-2021-36091 | 4.3 | Jul 26 | Agents are able to list appointments in the calendars without required permissions Affected: 6.0.0 before 6.0.32; 7.0.0 before 7.0.28 |
| CVE-2021-21443 | 4.3 | Jul 26 | Agents are able to list customer user emails without required permissions in the bulk action screen Affected: 6.0.0 through 6.0.32; 7.0.0 through 7.0.27 |
| CVE-2021-21438 | 4.3 | Mar 22 | Agents are able to see linked FAQ articles without permissions (defined in FAQ Category) Affected: 7.0.0 before 7.0.24 |
| CVE-2020-1778 | 4.3 | Nov 23 | When OTRS uses multiple backends for user authentication (with LDAP), agents are able to login even if the account is set to invalid Affected: through 8.0.9 |
| CVE-2020-1776 | 4.3 | Jul 20 | When an agent user is renamed or set to invalid the session belonging to the user is keept active Affected: before 6.0.29; 7.0.0 before 7.0.19; 8.0.1 before 8.0.5 |
| CVE-2020-1775 | 4.3 | Jun 8 | BCC recipients in mails sent from OTRS are visible in article detail on external interface Affected: 7.0.0 before 7.0.18; 8.0.0 before 8.0.3 |
| CVE-2020-1770 | 4.3 | Mar 27 | Support bundle generated files could contain sensitive information that might be unwanted to be disclosed Affected: 5.0.0 through 5.0.41; 6.0.0 through 6.0.26; 7.0.0 through 7.0.15 |
| CVE-2020-1769 | 4.3 | Mar 27 | In the login screens (in agent and customer interface), Username and Password fields use autocomplete, which might be considered as security issue Affected: 5.0.0 through 5.0.41; 6.0.0 through 6.0.26; 7.0.0 through 7.0.15 |
| CVE-2019-13457 | 4.3 | Mar 10 | An issue was discovered in Open Ticket Request System (OTRS) 7.0.x through 7.0.8 Affected: 7.0.0 through 7.0.8 |
| CVE-2019-10065 | 4.3 | Mar 10 | An issue was discovered in Open Ticket Request System (OTRS) 7.0 through 7.0.6 Affected: 7.0.0 through 7.0.6 |
| CVE-2020-1767 | 4.3 | Jan 10 | Agent A is able to save a draft (i.e Affected: 6.0.0 through 6.0.24; 7.0.0 through 7.0.13 |
| CVE-2019-18179 | 4.3 | Jan 6 | An issue was discovered in Open Ticket Request System (OTRS) 7.0.x through 7.0.12, and Community Edition 5.0.x through 5.0.38 and 6.0.x through 6.0.23 Affected: 5.0.0 through 5.0.38; 6.0.0 through 6.0.23; 7.0.0 through 7.0.12 |
| CVE-2019-12248 | 4.3 | Jun 17 | An issue was discovered in Open Ticket Request System (OTRS) 7.0.x through 7.0.7, Community Edition 6.0.x through 6.0.19, and Community Edition 5.0.x through 5.0.36 Affected: 5.0.0 through 5.0.36; 6.0.0 through 6.0.19; 7.0.0 through 7.0.7 |
| CVE-2019-9753 | 4.3 | Jun 3 | An issue was discovered in Open Ticket Request System (OTRS) 7.x before 7.0.5 Affected: 7.0.0 before 7.0.5 |
| CVE-2018-10198 | 4.3 | Jun 6 | An issue was discovered in OTRS 6.0.x before 6.0.7 Affected: 6.0.0 before 6.0.7 |