PT-2023-20028 · Otrs · Otrs

Maximilian Gutwein · Published 2023-05-08 · Updated 2023-05-16 · CVE-2023-2534

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions OTRS versions 8.0.X through 8.0.31

Description The issue allows any authenticated attacker as an Agent to track user behavior and gain live insight into overall system usage. User IDs can easily be correlated with real names, for example, via ticket histories by any user. Subscribing to all possible push events could also lead to performance implications on the server side, depending on the size of the installation and the number of active users.

Recommendations For versions 8.0.X through 8.0.31, update to version 8.0.32 or later to resolve the issue. As a temporary workaround, consider restricting access to the Websocket API backend to minimize the risk of exploitation. Additionally, restrict the ability to subscribe to all possible push events to prevent potential performance implications on the server side.

Fix

Incorrect Authorization

Improper Authorization

Weakness Enumeration

CWE-863

CWE-285

Related Identifiers

CVE-2023-2534

Affected Products

Otrs

References · 4

• https://otrs.com/release-notes/otrs-security-advisory-2023-03 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-2534 · Security Note
• https://osv.dev/vulnerability/CVE-2023-2534 · Vendor Advisory
• https://t.me/cvenotify/49926 · Telegram Post