Otrs

Otrs

138 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
5.4

CVE-2013-4718

  • EPSS 0.18%
  • Veröffentlicht 09.08.2021 19:15:07
  • Zuletzt bearbeitet 21.11.2024 01:56:07

Cross-site scripting (XSS) vulnerability in Open Ticket Request System (OTRS) ITSM 3.0.x before 3.0.9, 3.1.x before 3.1.10, and 3.2.x before 3.2.7 allows remote authenticated users to inject arbitrary web script or HTML via an ITSM ConfigItem search.

6.5

CVE-2021-21440

  • EPSS 0.18%
  • Veröffentlicht 26.07.2021 05:15:07
  • Zuletzt bearbeitet 21.11.2024 05:48:22

Generated Support Bundles contains private S/MIME and PGP keys if containing folder is not hidden. This issue affects: OTRS AG ((OTRS)) Community Edition 6.0.x version 6.0.1 and later versions. OTRS AG OTRS 7.0.x version 7.0.27 and prior versions; 8....

4.3

CVE-2021-21443

  • EPSS 0.3%
  • Veröffentlicht 26.07.2021 05:15:07
  • Zuletzt bearbeitet 21.11.2024 05:48:23

Agents are able to list customer user emails without required permissions in the bulk action screen. This issue affects: OTRS AG ((OTRS)) Community Edition: 6.0.x version 6.0.1 and later versions. OTRS AG OTRS: 7.0.x versions prior to 7.0.27.

4.3

CVE-2021-36091

  • EPSS 0.18%
  • Veröffentlicht 26.07.2021 05:15:07
  • Zuletzt bearbeitet 21.11.2024 06:13:08

Agents are able to list appointments in the calendars without required permissions. This issue affects: OTRS AG ((OTRS)) Community Edition: 6.0.x version 6.0.1 and later versions. OTRS AG OTRS: 7.0.x versions prior to 7.0.27.

6.1

CVE-2021-36092

  • EPSS 0.36%
  • Veröffentlicht 26.07.2021 05:15:07
  • Zuletzt bearbeitet 21.11.2024 06:13:08

It's possible to create an email which contains specially crafted link and it can be used to perform XSS attack. This issue affects: OTRS AG ((OTRS)) Community Edition:6.0.x version 6.0.1 and later versions. OTRS AG OTRS: 7.0.x version 7.0.27 and pri...

7.5

CVE-2021-21441

  • EPSS 0.41%
  • Veröffentlicht 16.06.2021 10:15:08
  • Zuletzt bearbeitet 21.11.2024 05:48:22

There is a XSS vulnerability in the ticket overview screens. It's possible to collect various information by having an e-mail shown in the overview screen. Attack can be performed by sending specially crafted e-mail to the system and it doesn't requi...

6.5

CVE-2021-21439

  • EPSS 0.51%
  • Veröffentlicht 14.06.2021 08:15:10
  • Zuletzt bearbeitet 21.11.2024 05:48:21

DoS attack can be performed when an email contains specially designed URL in the body. It can lead to the high CPU usage and cause low quality of service, or in extreme case bring the system to a halt. This issue affects: OTRS AG ((OTRS)) Community E...

4.3

CVE-2021-21438

  • EPSS 0.17%
  • Veröffentlicht 22.03.2021 09:15:13
  • Zuletzt bearbeitet 21.11.2024 05:48:21

Agents are able to see linked FAQ articles without permissions (defined in FAQ Category). This issue affects: FAQ version 6.0.29 and prior versions, OTRS version 7.0.24 and prior versions.

6.5

CVE-2021-21435

  • EPSS 0.29%
  • Veröffentlicht 08.02.2021 11:15:14
  • Zuletzt bearbeitet 21.11.2024 05:48:21

Article Bcc fields and agent personal information are shown when customer prints the ticket (PDF) via external interface. This issue affects: OTRS AG OTRS 7.0.x version 7.0.23 and prior versions; 8.0.x version 8.0.10 and prior versions.

4.3

CVE-2020-1778

  • EPSS 0.23%
  • Veröffentlicht 23.11.2020 16:15:13
  • Zuletzt bearbeitet 21.11.2024 05:11:22

When OTRS uses multiple backends for user authentication (with LDAP), agents are able to login even if the account is set to invalid. This issue affects OTRS; 8.0.9 and prior versions.