Upload of files outside application directory
CVE-2024-23793
6.3MEDIUM
Key Information
- Vendor
- Otrs Ag
- Status
- Otrs
- ((otrs)) Community Edition
- Vendor
- CVE Published:
- 6 June 2024
Summary
The file upload feature in OTRS and ((OTRS)) Community Edition has a path traversal vulnerability. This issue permits authenticated agents or customer users to upload potentially harmful files to directories accessible by the web server, potentially leading to the execution of local code like Perl scripts. This issue affects OTRS: from 7.0.X through 7.0.49, 8.0.X, 2023.X, from 2024.X through 2024.3.2; ((OTRS)) Community Edition: from 6.0.1 through 6.0.34.
Affected Version(s)
OTRS <= 7.0.49
OTRS <= 7.0.49
OTRS = 8.0.x
CVSS V3.1
Score:
6.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged
Timeline
Vulnerability published.
Vulnerability Reserved.
Collectors
NVD DatabaseMitre Database