Medium severity · published Jun 6, 2024
CVE-2024-23793
Upload of files outside application directory
6.3
CVSS
0.8%
EPSS
No
On KEV
Description
The file upload feature in OTRS and ((OTRS)) Community Edition has a path traversal vulnerability. This issue permits authenticated agents or customer users to upload potentially harmful files to directories accessible by the web server, potentially leading to the execution of local code like Perl scripts.
This issue affects OTRS: from 7.0.X through 7.0.49, 8.0.X, 2023.X, from 2024.X through 2024.3.2; ((OTRS)) Community Edition: from 6.0.1 through 6.0.34.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:L
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
None
Integrity
High
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 56% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OC
((OTRS)) Community Edition · OTRS AG
6.0.1 through 6.0.34 · source: vendor
OT
OTRS · OTRS AG
7.0.x through 7.0.49; 8.0.x; 2023.x; 2024.x through 2024.3.2 · source: vendor, CISA
OC
Otrs Community Edition · Otrs
6.0.1 before 6.0.34 · source: CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-23793
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-23793
otrs.com
https://otrs.com/release-notes/otrs-security-advisory-2024-05/
More from ((OTRS)) Community Edition
9.1
CVE-2026-48188
SQL Injection via MySQL Quote Method
8.2
CVE-2024-43444
Passwords are written to Admin Log Module
7.1
CVE-2026-48209
Reflected XSS in authenticated agent context
6.5
CVE-2026-48208
Denial-of-Service via SVG Rendering in Ticket
6.5
CVE-2022-39052
DoS attack using email