PT-2025-5354 · Otrs+1 · Otrs+1

Published 2025-01-27 · Updated 2025-01-27 · CVE-2025-24389

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions OTRS versions 7.0.X through 2024.X ((OTRS)) Community Edition version 6.0.x

Description Certain errors of the upstream libraries will insert sensitive information in the log mechanism and mails sent to the system administrator. Products based on the ((OTRS)) Community Edition are also very likely to be affected.

Recommendations For OTRS versions 7.0.X through 2024.X, consider restricting access to the log mechanism and system administrator mails until a patch is available. For ((OTRS)) Community Edition version 6.0.x, consider disabling the log mechanism temporarily to minimize the risk of sensitive information exposure. As a temporary workaround, consider implementing additional logging and monitoring measures to detect potential sensitive information leaks.

Fix

Insertion into Log File

Weakness Enumeration

CWE-532

Related Identifiers

CVE-2025-24389

Affected Products

Otrs

Otrs Community Edition

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-24389 · Security Note
• https://twitter.com/VulmonFeeds/status/1883765380641919113 · Twitter Post
• https://otrs.com/release-notes/otrs-security-advisory-2025-03 · Note
• https://twitter.com/CVEnew/status/1883761737373012258 · Twitter Post
• https://t.me/cvedetector/16431 · Telegram Post