PT-2019-12716 · Otrs+2 · Otrs+3
Matthias Terlinde
·
Publicado
2019-06-11
·
Atualizado
2023-08-31
·
CVE-2019-12248
CVSS v3.1
4.3
Média
| Vetor | AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
Open Ticket Request System (OTRS) versions 7.0.x through 7.0.7
Open Ticket Request System (OTRS) Community Edition versions 6.0.x through 6.0.19
Open Ticket Request System (OTRS) Community Edition versions 5.0.x through 5.0.36
Description
An issue was discovered in Open Ticket Request System (OTRS) where an attacker could send a malicious email to an OTRS system. If a logged-in agent user quotes it, the email could cause the browser to load external image resources.
Recommendations
For Open Ticket Request System (OTRS) versions 7.0.x through 7.0.7, update to a version outside of this range to mitigate the risk.
For Open Ticket Request System (OTRS) Community Edition versions 6.0.x through 6.0.19, update to a version outside of this range to mitigate the risk.
For Open Ticket Request System (OTRS) Community Edition versions 5.0.x through 5.0.36, update to a version outside of this range to mitigate the risk.
As a temporary workaround, consider restricting the ability of agent users to quote emails from untrusted sources until a patch is available.
Correção
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Alt Linux
Otrs
Otrs Community Edition
Suse