PT-2023-16839 · Otrs Ag+1 · Otrs Community Edition+2

Tim Püttmanns · Published 2021-09-29 · Updated 2024-08-06 · CVE-2023-1250

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OTRS versions 7.0.X through 7.0.41 OTRS versions 8.0.X through 8.0.30 OTRS Community Edition versions 6.0.1 through 6.0.34

Description The issue is related to an Improper Input Validation vulnerability in the ACL modules of OTRS AG OTRS and OTRS Community Edition. This vulnerability allows Local Execution of Code when creating or importing an ACL, as it is possible to inject code via manipulated comments and ACL names.

Recommendations For OTRS versions 7.0.X through 7.0.41, update to version 7.0.42 or later. For OTRS versions 8.0.X through 8.0.30, update to version 8.0.31 or later. For OTRS Community Edition versions 6.0.1 through 6.0.34, update to version 6.0.35 or later. As a temporary workaround, consider restricting the creation and import of ACLs to minimize the risk of exploitation.

Fix

RCE

Code Injection

Weakness Enumeration

CWE-20

CWE-94

Related Identifiers

ALT-PU-2021-2917

ALT-PU-2021-3039

ALT-PU-2021-3058

ALT-PU-2024-10583

CVE-2023-1250

Affected Products

Alt Linux

Otrs

Otrs Community Edition

References · 9

• https://osv.dev/vulnerability/UBUNTU-CVE-2023-1250 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-1250 · Security Note
• https://osv.dev/vulnerability/CVE-2023-1250 · Vendor Advisory
• https://otrs.com/release-notes/otrs-security-advisory-2023-02 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-1250 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-1250 · Security Note
• https://t.me/cvenotify/46800 · Telegram Post
• https://t.me/cibsecurity/60303 · Telegram Post
• https://t.me/cvenotify/46502 · Telegram Post