PT-2025-2647 · Otrs+1 · Otrs+1

Alissa Kim · Published 2024-08-13 · Updated 2025-01-27 · CVE-2024-43445

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions OTRS versions 6.0.x through 8.0.x OTRS versions 2023.x through 2024.x OTRS Community Edition version 6.0.x

Description The issue is related to the incorrect handling of HTTP request headers due to insufficient input validation, which may allow a remote attacker to upload arbitrary files. This vulnerability can be exploited by uploading or inserting content that would be treated as a different MIME type than intended, as the HTTP response header X-Content-Type-Options is not set to nosniff.

Recommendations For OTRS versions 6.0.x through 8.0.x, consider setting the HTTP response header X-Content-Type-Options to nosniff to prevent MIME type confusion. For OTRS versions 2023.x through 2024.x, set the HTTP response header X-Content-Type-Options to nosniff to mitigate the risk of exploitation. For OTRS Community Edition version 6.0.x, apply the same mitigation as for the standard OTRS versions by setting the X-Content-Type-Options header to nosniff.

Fix

RCE

Weakness Enumeration

CWE-644

CWE-20

Related Identifiers

BDU:2025-01304

CVE-2024-43445

Affected Products

Otrs

Otrs Community Edition

References · 6

• https://otrs.com/release-notes/otrs-security-advisory-2025-01 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-01304 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-43445 · Security Note
• https://t.me/cvedetector/16440 · Telegram Post
• https://vuldb.com/?id.293506 · Note
• https://twitter.com/CVEnew/status/1883761739172327622 · Twitter Post