Advisories · Technology
OTRS.
Every CVE that names OTRS among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 5.7 Medium
XSS attack in appointment edit popup screen
- OTRS AG ((OTRS)) Community Edition
- OTRS
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
DoS attack using PostMaster filters
- OTRS AG ((OTRS)) Community Edition
- OTRS
- CWE-185
- CVSS 6.5 Medium
XSS attack using special link in email
- OTRS AG ((OTRS)) Community Edition
- OTRS
- Cross-site scripting (XSS)
- CVSS 3.5 Low
Unautorized access to the calendar appointments
- OTRS AG ((OTRS)) Community Edition
- OTRS
- Information disclosure
- CVSS 3.5 Low
Unautorized listing of the customer user emails
- OTRS AG ((OTRS)) Community Edition
- OTRS
- Information disclosure
- CVSS 5.2 Medium
Support Bundle includes S/Mime and PGP keys
- OTRS AG ((OTRS)) Community Edition
- OTRS
- Information disclosure
- CVSS 7.5 High
XSS in the ticket overview screens
- OTRS AG ((OTRS)) Community Edition
- OTRS
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
Possible DoS attack using a special crafted URL in email body
- OTRS AG ((OTRS)) Community Edition
- OTRS
- CWE-754
- CVSS 3.5 Low
FAQ articles are shown to users without permission
- OTRS AG FAQ
- OTRS
- CWE-264
- CVSS 5.7 Medium
Information exposure in PDF export
- OTRS
- Information disclosure
- CVSS 4.1 Medium
Bypassing user account validation
- OTRS
- Authentication bypass
- CVSS 4.3 Medium
Agent names disclosed in chat feature
- OTRS
- Information disclosure
- CVSS 3.5 Low
Invalidating or changing user does not invalidate session
- OTRS AG ((OTRS)) Community Edition
- OTRS
- Authentication bypass
- CVSS 3.5 Low
Information disclosure in external interface
- OTRS
- Information disclosure
- CVSS 4.5 Medium
Information disclosure
- OTRS AG ((OTRS)) Community Edition
- OTRS
- Information disclosure
- CVSS 7.3 High
Session / Password / Password token leak
- OTRS AG ((OTRS)) Community Edition
- OTRS
- CWE-331
- CVSS 6.5 Medium
Information Disclosure
- OTRS AG ((OTRS)) Community Edition
- OTRS
- CWE-155
- CVSS 4.6 Medium
Possible XSS in Customer user address book
- OTRS AG ((OTRS)) Community Edition
- OTRS
- Cross-site scripting (XSS)
- CVSS 2.4 Low
Information disclosure in support bundle files
- OTRS AG ((OTRS)) Community Edition
- OTRS
- Information disclosure
- CVSS 3.5 Low
Autocomplete in the form login screens
- OTRS AG ((OTRS)) Community Edition
- OTRS
- CWE-16
- CVSS 5.4 Medium
External Interface does not invalidate session
- OTRS
- Authentication bypass
- CVSS 3.5 Low
Possible to send drafted messages as wrong agent
- OTRS AG ((OTRS)) Community Edition
- OTRS
- CVSS 2.0 Low
Improper handling of uploaded inline images
- OTRS AG ((OTRS)) Community Edition
- OTRS
- Cross-site scripting (XSS)
- CVSS 3.5 Low
Spoofing of From field in several screens
- OTRS AG ((OTRS)) Community Edition
- OTRS
- CWE-472