PT-2023-32579 · Otrs · Otrs

Matthias Püschel · Published 2023-11-27 · Updated 2023-12-01 · CVE-2023-6254

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions OTRS versions 8.0.X through 8.0.37

Description A vulnerability in OTRS AgentInterface and ExternalInterface allows the reading of plain text passwords, which are sent back to the client in the server response.

Recommendations For OTRS versions 8.0.X through 8.0.37, update to a version that includes the fix for this issue to prevent the reading of plain text passwords. As a temporary workaround, consider restricting access to the AgentInterface and ExternalInterface until a patch is available.

Fix

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

Related Identifiers

CVE-2023-6254

Affected Products

Otrs

References · 8

• https://osv.dev/vulnerability/UBUNTU-CVE-2023-6254 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-6254 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-6254 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-6254 · Security Note
• https://otrs.com/release-notes/otrs-security-advisory-2023-11 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-6254 · Security Note
• https://t.me/cvenotify/61224 · Telegram Post
• https://t.me/cvenotify/61835 · Telegram Post