PT-2022-13199 · Unknown · Otrscustomcontactfields

Published 2022-02-07 · Updated 2022-02-25 · CVE-2022-0474

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Low

Base vector

AV:N/AC:M/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions OTRSCustomContactFields versions 8.0.11 and prior versions.

Description The issue allows the full list of recipients from customer users in a contact field to be disclosed in notification emails, even when the notification is set to be sent to each recipient individually.

Recommendations For versions 8.0.11 and prior, consider disabling the notification feature that sends emails to each recipient individually until a fix is available. Restrict access to the contact field to minimize the risk of recipient disclosure.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2022-0474

Affected Products

Otrscustomcontactfields

References · 4

• https://otrs.com/release-notes/otrs-security-advisory-2022-02 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-0474 · Security Note
• https://osv.dev/vulnerability/CVE-2022-0474 · Vendor Advisory
• https://t.me/cibsecurity/36928 · Telegram Post