PT-2024-2035 · Otrs+1 · Otrs+1

Published 2024-01-29 · Updated 2024-02-02 · CVE-2024-23791

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions OTRS versions 7.0.X through 7.0.48 OTRS versions 8.0.X through 8.0.37 OTRS versions 2023.X through 2023.1.1

Description The issue is related to the insertion of debug information into a log file during the building of an Elasticsearch index, which allows the reading of sensitive information from articles. This can be exploited by a remote attacker to disclose protected information.

Recommendations For OTRS versions 7.0.X through 7.0.48, update to a version outside of this range to resolve the issue. For OTRS versions 8.0.X through 8.0.37, update to a version outside of this range to resolve the issue. For OTRS versions 2023.X through 2023.1.1, update to a version outside of this range to resolve the issue. As a temporary workaround, consider restricting access to the log files to minimize the risk of exploitation.

Fix

Insertion into Log File

Weakness Enumeration

CWE-532

Related Identifiers

BDU:2024-01913

CVE-2024-23791

Affected Products

Elasticsearch

Otrs

References · 10

• https://bdu.fstec.ru/vul/2024-01913 · Security Note
• https://cve.org/CVERecord?id=CVE-2024-23791 · Security Note
• https://otrs.com/release-notes/otrs-security-advisory-2024-02 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-23791 · Security Note
• https://osv.dev/vulnerability/CVE-2024-23791 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-23791 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-23791 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1751929976872472732 · Twitter Post
• https://t.me/cvenotify/69042 · Telegram Post
• https://twitter.com/CVEnew/status/1751902438179631179 · Twitter Post