PT-2025-10569 · Otrs · Otrs

Alissa Kim · Published 2025-03-10 · Updated 2025-03-24 · CVE-2025-24387

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions OTRS versions 7.0.X through 2025.x

Description A vulnerability in OTRS Application Server allows session hijacking due to missing attributes for sensitive cookie settings in HTTPS sessions. This can occur when a request is made to an OTRS endpoint from a possible malicious web site, resulting in the authentication cookie being sent and performing an unwanted read operation.

Recommendations For OTRS versions 7.0.X through 2025.x, consider restricting access to sensitive cookie settings to minimize the risk of session hijacking until a patch is available. As a temporary workaround, review and adjust the HTTPS session settings to include proper attributes for sensitive cookies.

Fix

CSRF

Weakness Enumeration

CWE-1275

CWE-352

Related Identifiers

CVE-2025-24387

Affected Products

Otrs

References · 9

• https://otrs.com/release-notes/otrs-security-advisory-2025-05 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-24387 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-24387 · Security Note
• https://twitter.com/VulmonFeeds/status/1899047182168109269 · Twitter Post
• https://t.me/cvenotify/115914 · Telegram Post
• https://t.me/cvedetector/19942 · Telegram Post
• https://t.me/cvetracker/18796 · Telegram Post
• https://t.me/cvenotify/114041 · Telegram Post
• https://twitter.com/CVEnew/status/1899031619735781610 · Twitter Post