6.5

CVE-2019-13458

An issue was discovered in Open Ticket Request System (OTRS) 7.0.x through 7.0.8, and Community Edition 5.0.x through 5.0.36 and 6.0.x through 6.0.19. An attacker who is logged into OTRS as an agent user with appropriate permissions can leverage OTRS notification tags in templates in order to disclose hashed user passwords.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Otrs ≫ Otrs SwEditioncommunity Version >= 5.0.0 <= 5.0.36
Otrs ≫ Otrs SwEditioncommunity Version >= 6.0.0 <= 6.0.19
Otrs ≫ Otrs Version >= 7.0.0 <= 7.0.8
Debian ≫ Debian Linux Version8.0
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.71% 0.743
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 6.5 2.8 3.6
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
nvd@nist.gov 4 8 2.9
AV:N/AC:L/Au:S/C:P/I:N/A:N
cve@mitre.org 2.7 1.2 1.4
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
Es wurden noch keine Informationen zu CWE veröffentlicht.
http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00038.html
Broken Link
http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00066.html
Broken Link
http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00077.html
Broken Link
https://lists.debian.org/debian-lts-announce/2023/08/msg00040.html
https://www.otrs.com/category/release-and-security-notes-en/
Release Notes
https://lists.debian.org/debian-lts-announce/2019/08/msg00018.html
Third Party Advisory
Mailing List
https://community.otrs.com/security-advisory-2019-12-security-update-for-otrs-framework/
Patch
Vendor Advisory