Password is send back to client
CVE-2023-6254

8.1HIGH

Key Information:

Vendor

Otrs Ag

Status
Otrs
Vendor
CVE Published:
27 November 2023

What is CVE-2023-6254?

A vulnerability in the OTRS AgentInterface and ExternalInterface components can lead to the exposure of plain text passwords. When a client interacts with the server, sensitive information is sent back without adequate protection, risking unauthorized access. This issue affects versions of OTRS from 8.0.X to 8.0.37, necessitating immediate updates to mitigate potential risks.

Affected Version(s)

OTRS 8.0.x <= 8.0.37

References

https://otrs.com/release-notes/otrs-security-advisory-202...

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Special thanks to Matthias PĂĽschel for reporting these vulnerability.
.