OT
Product
Otrs
142
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 4High 23Medium 68Low 2
Watch
Add Otrs to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2023-38060 | 8.8 | Jul 24 | Improper Input Validation vulnerability in the ContentType parameter for attachments on TicketCreate or TicketUpdate operations of the OTRS Generic Interface modules allows any… Affected: 6.0.1 through 6.0.34; 7.0.0 before 7.0.45; 8.0.0 before 8.0.35 |
| CVE-2022-39051 | 8.8 | Sep 5 | Attacker might be able to execute malicious Perl code in the Template toolkit, by having the admin installing an unverified 3th party package Affected: 6.0.0 through 6.0.32; 7.0.0 before 7.0.37; 8.0.0 before 8.0.25 |
| CVE-2021-36100 | 8.8 | Mar 21 | Specially crafted string in OTRS system configuration can allow the execution of any system command Affected: before 7.0.28; 7.0.30 before 7.0.33; 8.0.0 before 8.0.21 |
| CVE-2013-4717 | 8.8 | Aug 9 | Multiple SQL injection vulnerabilities in Open Ticket Request System (OTRS) Help Desk 3.0.x before 3.0.22, 3.1.x before 3.1.18, and 3.2.x before 3.2.9 allow remote authenticated… Affected: 3.0.0 through 3.0.21; 3.1.0 through 3.1.17; 3.2.0 through 3.2.8 |
| CVE-2017-17476 | 8.8 | Dec 20 | Open Ticket Request System (OTRS) 4.0.x before 4.0.28, 5.0.x before 5.0.26, and 6.0.x before 6.0.3, when cookie support is disabled, might allow remote attackers to hijack web… Affected: 4.0.0 before 4.0.28; 5.0.0 before 5.0.26; 6.0.0 before 6.0.3 |
| CVE-2017-16921 | 8.8 | Dec 8 | In OTRS 6.0.x up to and including 6.0.1, OTRS 5.0.x up to and including 5.0.24, and OTRS 4.0.x up to and including 4.0.26, an attacker who is logged into OTRS as an agent can… Affected: 4.0.1; 4.0.2; 4.0.3; 4.0.4; 4.0.5; 4.0.6; +34 more |
| CVE-2017-16664 | 8.8 | Nov 21 | Code injection exists in Kernel/System/Spelling.pm in Open Ticket Request System (OTRS) 5 before 5.0.24, 4 before 4.0.26, and 3.3 before 3.3.20 Affected: 3.3.0 before 3.3.20; 4.0.0 before 4.0.26; 5.0.0 before 5.0.24 |
| CVE-2017-15864 | 8.8 | Nov 16 | In the Agent Frontend in Open Ticket Request System (OTRS) 3.3.x through 3.3.18, with a crafted URL it is possible to gain information like database user and password Affected: 3.3.0 through 3.3.18 |
| CVE-2017-14635 | 8.8 | Sep 21 | In Open Ticket Request System (OTRS) 3.3.x before 3.3.18, 4.x before 4.0.25, and 5.x before 5.0.23, remote authenticated users can leverage statistics-write permissions to gain… Affected: 3.3.0; 3.3.0; 3.3.0; 3.3.0; 3.3.0; 3.3.0; +34 more |
| CVE-2017-9324 | 8.8 | Jun 12 | In Open Ticket Request System (OTRS) 3.3.x through 3.3.16, 4.x through 4.0.23, and 5.x through 5.0.19, an attacker with agent permission is capable of opening a specific URL in a… Affected: 3.3.0 through 3.3.16; 4.0.0 through 4.0.23; 5.0.0 through 5.0.19 |
| CVE-2023-2534 | 8.1 | May 8 | Improper Authorization vulnerability in OTRS AG OTRS 8 (Websocket API backend) allows any as Agent authenticated attacker to track user behaviour and to gain live insight into… Affected: 8.0.0 before 8.0.32 |
| CVE-2020-1773 | 8.1 | Mar 27 | An attacker with the ability to generate session IDs or password reset tokens, either by being able to authenticate or by exploiting OSA-2020-09, may be able to predict other… Affected: 5.0.0 through 5.0.41; 6.0.0 through 6.0.26; 7.0.0 through 7.0.15 |
| CVE-2023-1250 | 7.8 | Mar 20 | Improper Input Validation vulnerability in OTRS AG OTRS (ACL modules), OTRS AG ((OTRS)) Community Edition (ACL modules) allows Local Execution of Code Affected: 6.0.1 through 6.0.34; 7.0.0 before 7.0.42; 8.0.0 before 8.0.31 |
| CVE-2024-23794 | 7.5 | Jul 15 | An incorrect privilege assignment vulnerability in the inline editing functionality of OTRS can lead to privilege escalation Affected: 8.0.0 before 2024.5.2 |
| CVE-2024-23791 | 7.5 | Jan 29 | Insertion of debug information into log file during building the elastic search index allows reading of sensitive information from articles.This issue affects OTRS: from 7.0.X… Affected: 7.0.0 before 7.0.49; 8.0.0 before 2024.1.1 |
| CVE-2023-6254 | 7.5 | Nov 27 | A Vulnerability in OTRS AgentInterface and ExternalInterface allows the reading of plain text passwords which are send back to the client in the server response- This issue… Affected: 8.0.1 through 8.0.37 |
| CVE-2022-3501 | 7.5 | Oct 17 | Information exposure of template content due to missing check of permissions Affected: 8.0.0 before 8.0.26 |
| CVE-2021-21441 | 7.5 | Jun 16 | There is a XSS vulnerability in the ticket overview screens Affected: 6.0.1 and later; 7.0.0 through 7.0.26 |
| CVE-2020-1772 | 7.5 | Mar 27 | It's possible to craft Lost Password requests with wildcards in the Token value, which allows attacker to retrieve valid Token(s), generated by users which already requested new… Affected: 5.0.0 through 5.0.41; 6.0.0 through 6.0.26; 7.0.0 through 7.0.15 |
| CVE-2019-18180 | 7.5 | Dec 5 | Improper Check for filenames with overly long extensions in PostMaster (sending in email) or uploading files (e.g Affected: 5.0.0 before 5.0.39; 6.0.0 before 6.0.24; 7.0.0 before 7.0.13 |
| CVE-2023-38056 | 7.2 | Jul 24 | Improper Neutralization of commands allowed to be executed via OTRS System Configuration e.g Affected: 6.0.1 through 6.0.34; 7.0.0 before 7.0.45; 8.0.0 before 8.0.35 |
| CVE-2018-7567 | 7.2 | Mar 4 | In the Admin Package Manager in Open Ticket Request System (OTRS) 5.0.0 through 5.0.24 and 6.0.0 through 6.0.1, authenticated admins are able to exploit a Blind Remote Code… Affected: 5.0.0 through 5.0.23; 6.0.0; 6.0.1 |
| CVE-2026-48209 | 7.1 | Jun 1 | Reflected XSS in authenticated agent context Affected: through 6.0.32; 7.0.0 through 7.0.49 |
Showing 23