PT-2025-25548 · Otrs+1 · Otrs+1

Alissa Kim · Published 2025-06-16 · Updated 2025-06-16 · CVE-2025-24388

Positive Technologies (AI Summary)

CVSS v3.1

3.8

Low

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions OTRS versions prior to 8 OTRS Community Edition version 6.0.x

Description A vulnerability in the OTRS Admin Interface and Agent Interface allows parameter injection for an authenticated agent or admin user. This issue affects several versions of OTRS, including OTRS 7.0.X, OTRS 8.0.X, OTRS 2023.X, OTRS 2024.X, and OTRS 2025.X. Products based on the OTRS Community Edition are also likely to be affected.

Recommendations For OTRS versions prior to 8, update to version 8 or later to resolve the issue. For OTRS Community Edition version 6.0.x, consider upgrading to a newer version or applying available patches to mitigate the risk. As a temporary workaround, consider restricting access to the Admin Interface and Agent Interface for authenticated agents and admin users until a patch is available.

Fix

Incomplete List of Disallowed Inputs

Weakness Enumeration

CWE-184

Related Identifiers

CVE-2025-24388

Affected Products

Otrs

Otrs Community Edition

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-24388 · Security Note
• https://twitter.com/CVEnew/status/1934577273157419283 · Twitter Post
• https://t.me/cvenotify/125767 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1934602628186444177 · Twitter Post
• https://t.me/cvetracker/26306 · Telegram Post
• https://otrs.com/release-notes/otrs-security-advisory-2025-06 · Note