László Gyaraki

**Name of the Vulnerable Software and Affected Versions** OTRS (affected versions not specified) **Description** The issue arises when the Secure::DisableBanner system configuration is disabled and an agent shares their calendar via a public URL. In this scenario, the received ICS file contains the OTRS release number. This potentially exposes sensitive information about the system. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: OTRS AG OTRSTicketForms versions 6.0.0 through 6.0.40 OTRS AG OTRSTicketForms versions 7.0.0 through 7.0.29 OTRS AG OTRSTicketForms versions 8.0.0 through 8.0.3 Description: The issue arises when dynamic templates are used, specifically with OTRSTicketForms. Administrators can utilize OTRS tags that are not properly masked, potentially revealing sensitive information. Recommendations: For versions 6.0.0 through 6.0.40, update to a version later than 6.0.40 to resolve the issue. For versions 7.0.0 through 7.0.29, update to a version later than 7.0.29 to resolve the issue. For versions 8.0.0 through 8.0.3, update to a version later than 8.0.3 to resolve the issue. As a temporary workaround, consider restricting the use of OTRS tags in dynamic templates until a patch is available.

**Name of the Vulnerable Software and Affected Versions** OTRS AG OTRS versions 7.0.x through 7.0.23 OTRS AG OTRS versions 8.0.x through 8.0.10 **Description** The issue concerns the exposure of Article Bcc fields and agent personal information when a customer prints a ticket in PDF format via an external interface. **Recommendations** For versions 7.0.x through 7.0.23, update to a version newer than 7.0.23 to resolve the issue. For versions 8.0.x through 8.0.10, update to a version newer than 8.0.10 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** OTRS versions 8.0.9 and prior **Description** The issue allows agents to login even if their account is set to invalid when OTRS uses multiple backends for user authentication with LDAP. **Recommendations** For versions 8.0.9 and prior, update to a version that contains a fix for this issue to prevent agents from logging in with invalid accounts.

**Name of the Vulnerable Software and Affected Versions** OTRS versions 7.0.21 and prior, 8.0.6 and prior **Description** The issue affects the system's ability to mask real agent names, revealing them in certain parts of the external interface and in chat transcriptions inside tickets. **Recommendations** For OTRS versions 7.0.21 and prior, update to a version later than 7.0.21 to resolve the issue. For OTRS versions 8.0.6 and prior, update to a version later than 8.0.6 to resolve the issue.