DeutschShown in its original language — a full translation is planned for a future version.
OTRS: Mehrere Schwachstellen
view advisory published 2026-10-11
Ein Angreifer kann mehrere Schwachstellen in OTRS ausnutzen, um seine Privilegien zu erhöhen, die Authentifizierung zu umgehen, vertrauliche Informationen offenzulegen, Daten zu manipulieren und Cross-Site-Scripting-Angriffe durchzuführen.
01
describes (9)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-93582US | — | — | ||
The HTTP Basic Authentication modules in ((OTRS)) Community Edition 6 and prior accept the authenticated username from either the REMOTE_USER or HTTP_REMOTE_USER environment variab… | ||||
| CVE-2026-93581US | — | — | ||
User-controlled values are not sufficiently neutralized when included in CSV exports. Values originating from user input, including data submitted by authenticated users or receive… | ||||
| CVE-2026-78359US | — | — | ||
OTRS does not sufficiently enforce the uniqueness of customer user identities across multiple configured CustomerUser backends. When multiple backends, such as a database and LDAP,… | ||||
| CVE-2026-78358US | — | — | ||
Several administrative actions do not sufficiently validate whether a request was intentionally initiated by the authenticated user. In particular, the DBUpdateLogCleanUp action ca… | ||||
| CVE-2026-78357US | — | — | ||
Previously issued authentication tokens are not immediately invalidated when an OTRS agent or customer user account is deactivated or its password is changed. As a result, an exist… | ||||
| CVE-2026-78356US | — | — | ||
The OTRS Agent Frontend configuration endpoint can be accessed without authentication. This allows unauthenticated remote users to retrieve internal application configuration that… | ||||
| CVE-2026-78355US | — | — | ||
A path traversal vulnerability in the OTRS SendSupportBundle functionality allows an authenticated administrator to reference file paths outside the intended directory.
This may a… | ||||
| CVE-2026-48212US | — | — | ||
An OTRS administrator can enter arbitrary JavaScript into the content of an OTRS Custom Page, which is stored by the application and subsequently executed in the browser of users a… | ||||
| CVE-2026-48211US | — | — | ||
An authenticated administrator can be induced to delete administrative Import/Export templates through a Cross-Site Request Forgery (CSRF) attack. The OTRS AdminImportExport::Templ… | ||||
02
references
External citations — patches, advisories, analysis.
- OTRS Security Advisory vom 2026-10-11external
- OTRS Security Advisory vom 2026-10-11external
- OTRS Security Advisory vom 2026-10-11external
- OTRS Security Advisory vom 2026-10-11external
- OTRS Security Advisory vom 2026-10-11external
- OTRS Security Advisory vom 2026-10-11external
- OTRS Security Advisory vom 2026-10-11external
- OTRS Security Advisory vom 2026-10-11external
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan