OT
Product
Otrs
144
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 4High 24Medium 69Low 2
Watch
Add Otrs to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2023-38060 | 8.8 | Jul 24 | Host header injection by attachments in web service Affected: 6.0.1 through 6.0.34; 7.0.0 before 7.0.45; 8.0.0 before 8.0.35 |
| CVE-2022-39051 | 8.8 | Sep 5 | Attacker might be able to execute malicious Perl code in the Template toolkit, by having the admin installing an unverified 3th party package Affected: 6.0.0 through 6.0.32; 7.0.0 before 7.0.37; 8.0.0 before 8.0.25 |
| CVE-2021-36100 | 8.8 | Mar 21 | Specially crafted string in OTRS system configuration can allow the execution of any system command Affected: before 7.0.28; 7.0.30 before 7.0.33; 8.0.0 before 8.0.21 |
| CVE-2013-4717 | 8.8 | Aug 9 | Multiple SQL injection vulnerabilities in Open Ticket Request System (OTRS) Help Desk 3.0.x before 3.0.22, 3.1.x before 3.1.18, and 3.2.x before 3.2.9 allow remote authenticated… Affected: 3.0.0 through 3.0.21; 3.1.0 through 3.1.17; 3.2.0 through 3.2.8 |
| CVE-2017-17476 | 8.8 | Dec 20 | Open Ticket Request System (OTRS) 4.0.x before 4.0.28, 5.0.x before 5.0.26, and 6.0.x before 6.0.3, when cookie support is disabled, might allow remote attackers to hijack web… Affected: 4.0.0 before 4.0.28; 5.0.0 before 5.0.26; 6.0.0 before 6.0.3 |
| CVE-2017-16921 | 8.8 | Dec 8 | In OTRS 6.0.x up to and including 6.0.1, OTRS 5.0.x up to and including 5.0.24, and OTRS 4.0.x up to and including 4.0.26, an attacker who is logged into OTRS as an agent can… Affected: 4.0.1; 4.0.2; 4.0.3; 4.0.4; 4.0.5; 4.0.6; +34 more |
| CVE-2017-16664 | 8.8 | Nov 21 | Code injection exists in Kernel/System/Spelling.pm in Open Ticket Request System (OTRS) 5 before 5.0.24, 4 before 4.0.26, and 3.3 before 3.3.20 Affected: 3.3.0 before 3.3.20; 4.0.0 before 4.0.26; 5.0.0 before 5.0.24 |
| CVE-2017-15864 | 8.8 | Nov 16 | In the Agent Frontend in Open Ticket Request System (OTRS) 3.3.x through 3.3.18, with a crafted URL it is possible to gain information like database user and password Affected: 3.3.0 through 3.3.18 |
| CVE-2017-14635 | 8.8 | Sep 21 | In Open Ticket Request System (OTRS) 3.3.x before 3.3.18, 4.x before 4.0.25, and 5.x before 5.0.23, remote authenticated users can leverage statistics-write permissions to gain… Affected: 3.3.0; 3.3.0; 3.3.0; 3.3.0; 3.3.0; 3.3.0; +34 more |
| CVE-2017-9324 | 8.8 | Jun 12 | In Open Ticket Request System (OTRS) 3.3.x through 3.3.16, 4.x through 4.0.23, and 5.x through 5.0.19, an attacker with agent permission is capable of opening a specific URL in a… Affected: 3.3.0 through 3.3.16; 4.0.0 through 4.0.23; 5.0.0 through 5.0.19 |
| CVE-2024-43444 | 8.2 | Aug 26 | Passwords are written to Admin Log Module Affected: 7.0.0 through 7.0.50; 8.0.0; 2023.0; 2024.0 through 2024.5.0; 6.0.0 |
| CVE-2023-2534 | 8.1 | May 8 | Information disclouse and DoS via websocket push events Affected: 8.0.0 before 8.0.32 |
| CVE-2020-1773 | 8.1 | Mar 27 | An attacker with the ability to generate session IDs or password reset tokens, either by being able to authenticate or by exploiting OSA-2020-09, may be able to predict other… Affected: 5.0.0 through 5.0.41; 6.0.0 through 6.0.26; 7.0.0 through 7.0.15 |
| CVE-2023-1250 | 7.8 | Mar 20 | Code execution through ACL creation Affected: 6.0.1 through 6.0.34; 7.0.0 before 7.0.42; 8.0.0 before 8.0.31 |
| CVE-2024-23794 | 7.5 | Jul 15 | Agents are able to lock the ticket without the "Owner" permission Affected: 8.0.0 before 2024.5.2 |
| CVE-2024-23791 | 7.5 | Jan 29 | Unnecessary data is written to log if issues during indexing occurs Affected: 7.0.0 before 7.0.49; 8.0.0 before 2024.1.1 |
| CVE-2023-6254 | 7.5 | Nov 27 | Password is send back to client Affected: 8.0.1 through 8.0.37 |
| CVE-2022-3501 | 7.5 | Oct 17 | Information exposure of template content due to missing check of permissions Affected: 8.0.0 before 8.0.26 |
| CVE-2021-21441 | 7.5 | Jun 16 | There is a XSS vulnerability in the ticket overview screens Affected: 6.0.1 and later; 7.0.0 through 7.0.26 |
| CVE-2020-1772 | 7.5 | Mar 27 | It's possible to craft Lost Password requests with wildcards in the Token value, which allows attacker to retrieve valid Token(s), generated by users which already requested new… Affected: 5.0.0 through 5.0.41; 6.0.0 through 6.0.26; 7.0.0 through 7.0.15 |
| CVE-2019-18180 | 7.5 | Dec 5 | Improper Check for filenames with overly long extensions in PostMaster (sending in email) or uploading files (e.g Affected: 5.0.0 before 5.0.39; 6.0.0 before 6.0.24; 7.0.0 before 7.0.13 |
| CVE-2023-38056 | 7.2 | Jul 24 | Code execution via System Configuration Affected: 6.0.1 through 6.0.34; 7.0.0 before 7.0.45; 8.0.0 before 8.0.35 |
| CVE-2018-7567 | 7.2 | Mar 4 | In the Admin Package Manager in Open Ticket Request System (OTRS) 5.0.0 through 5.0.24 and 6.0.0 through 6.0.1, authenticated admins are able to exploit a Blind Remote Code… Affected: 5.0.0 through 5.0.23; 6.0.0; 6.0.1 |
| CVE-2026-48209 | 7.1 | Jun 1 | Reflected XSS in authenticated agent context Affected: through 6.0.32; 7.0.0 through 7.0.49 |
Showing 24