PT-2024-20089 · Otrs Ag · Otrs Community Edition+1

Published 2024-06-06 · Updated 2024-06-07 · CVE-2024-23793

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:L

Name of the Vulnerable Software and Affected Versions OTRS versions 7.0.X through 7.0.49 OTRS versions 8.0.X OTRS version 2023.X OTRS versions 2024.X through 2024.3.2 ((OTRS)) Community Edition versions 6.0.1 through 6.0.34

Description The file upload feature in OTRS and ((OTRS)) Community Edition has a path traversal issue. This permits authenticated agents or customer users to upload potentially harmful files to directories accessible by the web server, potentially leading to the execution of local code like Perl scripts.

Recommendations For OTRS versions 7.0.X through 7.0.49, update to a version outside of this range to resolve the issue. For OTRS versions 8.0.X, update to a version outside of this range to resolve the issue. For OTRS version 2023.X, update to a version outside of this range to resolve the issue. For OTRS versions 2024.X through 2024.3.2, update to a version outside of this range to resolve the issue. For ((OTRS)) Community Edition versions 6.0.1 through 6.0.34, update to a version outside of this range to resolve the issue. As a temporary workaround, consider restricting access to the file upload feature until a patch is available.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2024-23793

Affected Products

Otrs

Otrs Community Edition

References · 7

• https://cve.org/CVERecord?id=CVE-2024-23793 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-23793 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-23793 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-23793 · Security Note
• https://twitter.com/CVEnew/status/1798781383395168439 · Twitter Post
• https://twitter.com/linuxpatch/status/1798808903033233521 · Twitter Post
• https://otrs.com/release-notes/otrs-security-advisory-2024-05 · Note