Approved changes feed: RSS · Atom
cpe:2.3:a:otrs:otrs:*:*:*:*:community:*:*:*
part: a version: * update: *
| Vendor | Otrs (265741d9-907d-5d62-a717-73ae1ea6326f) |
|---|---|
| Product | Otrs (a4c8163c-3d72-56f2-bdc3-a93fd57d712f) |
| Edition | * |
| Language | * |
| Software edition | community |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from purl2cpe mapping |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:deb/debian/otrs |
purl2cpe | 2026-06-01 10:13:48.016600 |
pkg:deb/ubuntu/otrs |
purl2cpe | 2026-06-01 10:13:48.016602 |
pkg:github/otrs/otrs |
purl2cpe | 2026-06-01 10:13:48.016604 |
pkg:rpm/fedora/otrs |
purl2cpe | 2026-06-01 10:13:48.016606 |
pkg:rpm/opensuse/otrs |
purl2cpe | 2026-06-01 10:13:48.016607 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2024-43444 |
vulnerable | 2026-06-08 06:45:51.339871 |
Passwords are written to Admin Log Module
HIGH (8.2)
Passwords of agents and customers are displayed in plain text in the OTRS admin log module if certain configurations regarding the authentication sources match and debugging for the authentication backend has been enabled.
This issue affects:
* OTRS from 7.0.X through 7.0.50
* OTRS 8.0.X
* OTRS 2023.X
* OTRS from 2024.X through 2024.5.X
* ((OTRS)) Community Edition: 6.0.x
Products based on the ((OTRS)) Community Edition also very likely to be affected
Published: 2024-08-26T08:42:58.796Z
Updated: 2024-08-29T07:36:13.555Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-5422 |
vulnerable | 2026-06-08 06:19:43.570998 |
SSL Certificates are not checked for E-Mail Handling
HIGH (8.7)
The functions to fetch e-mail via POP3 or IMAP as well as sending e-mail via SMTP use OpenSSL for static SSL or TLS based communication. As the
SSL_get_verify_result() function is not used the certificated is trusted always and it can not be ensured that the certificate
satisfies all necessary security requirements.
This could allow an
attacker to use an invalid certificate to claim to be a trusted host,
use expired certificates, or conduct other attacks that could be
detected if the certificate is properly validated.
This issue affects OTRS: from 7.0.X before 7.0.47, from 8.0.X before 8.0.37; ((OTRS)) Community Edition: from 6.0.X through 6.0.34.
Published: 2023-10-16T08:10:35.192Z
Updated: 2024-09-16T17:02:52.542Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-5421 |
vulnerable | 2026-06-08 06:19:43.568237 |
Possible XSS execution in customer information
LOW (3.5)
An attacker who is logged into OTRS as an user with privileges to create and change customer user data may manipulate the CustomerID field to execute JavaScript code that runs
immediatly after the data is saved.The issue onlyoccurs if the configuration for AdminCustomerUser::UseAutoComplete was changed before.
This issue affects OTRS: from 7.0.X before 7.0.47, from 8.0.X before 8.0.37; ((OTRS)) Community Edition: from 6.0.X through 6.0.34.
Published: 2023-10-16T08:10:55.114Z
Updated: 2024-09-16T16:55:01.099Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-38060 |
vulnerable | 2026-06-08 06:08:16.834875 |
Host header injection by attachments in web service
MEDIUM (6.3)
Improper Input Validation vulnerability in the ContentType parameter for attachments on TicketCreate or TicketUpdate operations of the OTRS Generic Interface modules allows any authenticated attacker to to perform an host header injection for the ContentType header of the attachment.
This issue affects OTRS: from 7.0.X before 7.0.45, from 8.0.X before 8.0.35; ((OTRS)) Community Edition: from 6.0.1 through 6.0.34.
Published: 2023-07-24T08:28:13.816Z
Updated: 2025-02-13T17:01:45.040Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-38059 |
vulnerable | 2026-06-08 06:08:16.834235 |
External pictures can be loaded even if not allowed by configuration
MEDIUM (5.3)
The loading of external images is not blocked, even if configured, if the attacker uses protocol-relative URL in the payload. This can be used to retreive the IP of the user.This issue affects OTRS: from 7.0.X before 7.0.47, from 8.0.X before 8.0.37; ((OTRS)) Community Edition: from 6.0.X through 6.0.34.
Published: 2023-10-16T08:10:44.014Z
Updated: 2024-09-16T16:56:26.630Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-38056 |
vulnerable | 2026-06-08 06:08:16.828968 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-1250 |
vulnerable | 2026-06-08 05:52:34.181011 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-1248 |
vulnerable | 2026-06-08 05:52:34.179114 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-4427 |
vulnerable | 2026-06-08 05:51:37.440656 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-39052 |
vulnerable | 2026-06-08 05:47:17.812738 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-39051 |
vulnerable | 2026-06-08 05:47:17.811995 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-39050 |
vulnerable | 2026-06-08 05:47:17.811438 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-39049 |
vulnerable | 2026-06-08 05:47:17.810332 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-36096 |
vulnerable | 2026-06-08 05:32:49.749111 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-36095 |
vulnerable | 2026-06-08 05:32:49.748527 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-36094 |
vulnerable | 2026-06-08 05:32:49.747895 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-36093 |
vulnerable | 2026-06-08 05:32:49.745679 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-36092 |
vulnerable | 2026-06-08 05:32:49.745243 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-36091 |
vulnerable | 2026-06-08 05:32:49.743793 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-21443 |
vulnerable | 2026-06-08 05:29:12.030697 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-21441 |
vulnerable | 2026-06-08 05:29:12.027624 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-21440 |
vulnerable | 2026-06-08 05:29:12.027120 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-21439 |
vulnerable | 2026-06-08 05:29:12.026652 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-21435 |
vulnerable | 2026-06-08 05:29:12.018003 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-1776 |
vulnerable | 2026-06-08 05:21:03.016926 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-1774 |
vulnerable | 2026-06-08 05:21:03.016026 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-1773 |
vulnerable | 2026-06-08 05:21:03.015607 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-1772 |
vulnerable | 2026-06-08 05:21:03.015067 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-1771 |
vulnerable | 2026-06-08 05:21:03.014549 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-1770 |
vulnerable | 2026-06-08 05:21:03.013803 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-1769 |
vulnerable | 2026-06-08 05:21:03.012965 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-1767 |
vulnerable | 2026-06-08 05:21:03.011872 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-1766 |
vulnerable | 2026-06-08 05:21:03.011397 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-1765 |
vulnerable | 2026-06-08 05:21:03.007590 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2019-18180 |
vulnerable | 2026-06-08 05:13:10.966563 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2019-18179 |
vulnerable | 2026-06-08 05:13:10.963447 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2019-16375 |
vulnerable | 2026-06-08 05:13:08.387391 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2019-13458 |
vulnerable | 2026-06-08 05:12:42.251915 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2019-12746 |
vulnerable | 2026-06-08 05:12:40.341678 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2019-12248 |
vulnerable | 2026-06-08 05:12:38.719083 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.