PT-2023-16839 · Otrs Ag+1 · Otrs Community Edition+2

Tim Püttmanns · Publicado 2021-09-29 · Atualizado 2024-08-06 · CVE-2023-1250

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OTRS versions 7.0.X through 7.0.41 OTRS versions 8.0.X through 8.0.30 OTRS Community Edition versions 6.0.1 through 6.0.34

Description The issue is related to an Improper Input Validation vulnerability in the ACL modules of OTRS AG OTRS and OTRS Community Edition. This vulnerability allows Local Execution of Code when creating or importing an ACL, as it is possible to inject code via manipulated comments and ACL names.

Recommendations For OTRS versions 7.0.X through 7.0.41, update to version 7.0.42 or later. For OTRS versions 8.0.X through 8.0.30, update to version 8.0.31 or later. For OTRS Community Edition versions 6.0.1 through 6.0.34, update to version 6.0.35 or later. As a temporary workaround, consider restricting the creation and import of ACLs to minimize the risk of exploitation.

Correção

RCE

Code Injection

Enumeração de Fraquezas

CWE-20

CWE-94

Identificadores relacionados

ALT-PU-2021-2917

ALT-PU-2021-3039

ALT-PU-2021-3058

ALT-PU-2024-10583

CVE-2023-1250

Produtos afetados

Alt Linux

Otrs

Otrs Community Edition

Referências · 9

• https://osv.dev/vulnerability/UBUNTU-CVE-2023-1250 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2023-1250 · Nota de Segurança
• https://t.me/cvenotify/46800 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-1250 · Aviso do Fabricante
• https://t.me/cibsecurity/60303 · Publicação no Telegram
• https://otrs.com/release-notes/otrs-security-advisory-2023-02 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2023-1250 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-1250 · Nota de Segurança
• https://t.me/cvenotify/46502 · Publicação no Telegram