Report feedback

An unauthenticated remote attacker can spoof content that is part of the HTTP response in OTRS and ((OTRS)) [1].

The vulnerability is present in products:

• OTRS; >=7.0, <7.1; >=8.0, <8.1; >=2023, <2025.1;
• ((OTRS)); >=6.0, <6.0.34;

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

More information:

• CVE-2024-43445 at cve.org, NVD
• CWE-20: Improper Input Validation at cwe.mitre.org

The vulnerability was publicly disclosed 27. 1. 2025.

An authenticated remote attacker can change the ticket status without authorization in OTRS and ((OTRS)) [2].

The vulnerability is present in products:

• OTRS; >=7.0, <7.1; >=8.0, <8.1; >=2023, <2025.1;
• ((OTRS)); >=6.0, <6.0.34;

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

More information:

• CVE-2024-43446 at cve.org, NVD
• CWE-269: Improper Privilege Management at cwe.mitre.org

The vulnerability was publicly disclosed 27. 1. 2025.

An authenticated remote attacker can access sensitive information from log files in OTRS and ((OTRS)). As a temporary fix, it is possible to disable SMTP in OTRS and use an MTA (Mail Transfer Agent) as a replacement (e.g. Postfix) [3]

The vulnerability is present in products:

• OTRS; >=7.0, <7.1; >=8.0, <8.1; >=2023, <2025.1;
• ((OTRS)); >=6.0, <6.0.34;

CVSS: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

More information:

• CVE-2025-24389 at cve.org, NVD
• CWE-532: Insertion of Sensitive Information into Log File at cwe.mitre.org

The vulnerability was publicly disclosed 27. 1. 2025.

Due to incorrect setting of cookie attributes in OTRS, an authenticated remote attacker can potentially obtain another user's session [4].

The vulnerability is present in product:

• OTRS; >=7.0, <7.1; >=8.0, <8.1; >=2023, <2025.1;

CVSS: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

More information:

• CVE-2025-24390 at cve.org, NVD
• CWE-614: Sensitive Cookie in HTTPS Session Without ‘Secure’ Attribute at cwe.mitre.org

The vulnerability was publicly disclosed 27. 1. 2025.