DeutschShown in its original language — a full translation is planned for a future version.
OTRS: Mehrere Schwachstellen
view advisory published 2022-03-20
Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in OTRS ausnutzen, um beliebigen Code auszuführen, einen Cross-Site-Scripting-Angriff auszuführen und vertrauliche Informationen offenzulegen.
01
describes (3)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2022-1004US | medium4.3 | — | ||
Accounted time is shown in the Ticket Detail View (External Interface), even if ExternalFrontend::TicketDetailView###AccountedTimeDisplay is disabled. | ||||
| CVE-2022-0475US | medium5.4 | — | ||
Malicious translator is able to inject JavaScript code in few translatable strings (where HTML is allowed). The code could be executed in the Package manager. This issue affects: O… | ||||
| CVE-2021-36100US | high8.8 | — | ||
Specially crafted string in OTRS system configuration can allow the execution of any system command. | ||||
02
references
External citations — patches, advisories, analysis.
- Exploit CVE-2021-36100 vom 2022-07-14external
- Debian Security Advisory DLA-3551 vom 2023-08-31external
- OTRS Security Advisory vom 2022-03-20external
- OTRS Security Advisory vom 2022-03-20external
- OTRS Security Advisory vom 2022-03-20external
- WID-SEC-W-2022-0691 - CSAF Versionself
- WID-SEC-2022-0691 - Portal Versionself
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan