PT-2023-20028 · Otrs · Otrs

Maximilian Gutwein · Publicado 2023-05-08 · Atualizado 2023-05-16 · CVE-2023-2534

Positive Technologies (AI Summary)

CVSS v3.1

8.1

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions OTRS versions 8.0.X through 8.0.31

Description The issue allows any authenticated attacker as an Agent to track user behavior and gain live insight into overall system usage. User IDs can easily be correlated with real names, for example, via ticket histories by any user. Subscribing to all possible push events could also lead to performance implications on the server side, depending on the size of the installation and the number of active users.

Recommendations For versions 8.0.X through 8.0.31, update to version 8.0.32 or later to resolve the issue. As a temporary workaround, consider restricting access to the Websocket API backend to minimize the risk of exploitation. Additionally, restrict the ability to subscribe to all possible push events to prevent potential performance implications on the server side.

Correção

Incorrect Authorization

Improper Authorization

Enumeração de Fraquezas

CWE-863

CWE-285

Identificadores relacionados

CVE-2023-2534

Produtos afetados

Otrs

Referências · 4

• https://otrs.com/release-notes/otrs-security-advisory-2023-03 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-2534 · Nota de Segurança
• https://t.me/cvenotify/49926 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-2534 · Aviso do Fabricante