OTRS vulnerabilities
3 known vulnerabilities in OTRS from OTRS GmbH (former OTRS AG). 3 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 9.4 Critical severity
OTRS: Authentication Bypass by Spoofing
The HTTP Basic Authentication modules in ((OTRS)) Community Edition 6 and prior accept the authenticated username from either the REMOTE_USER or HTTP_REMOTE_USER environment variable. In CGI and mod_perl based deployments, HTTP request headers may be mapped to
- 9.1 Critical severity
Previously issued authentication tokens are not immediately invalidated when an OTRS agent or…
Previously issued authentication tokens are not immediately invalidated when an OTRS agent or customer user account is deactivated or its password is changed. As a result, an existing JWT may remain valid until its regular expiration time, which can be approxi
- 8.7 High severity
OTRS: Improper Limitation of a Pathname to a Restricted Directory
A path traversal vulnerability in the OTRS SendSupportBundle functionality allows an authenticated administrator to reference file paths outside the intended directory. This may allow files accessible to the OTRS application process to be deleted. The vulnerab