Plain Text Passwords Displayed in OTRS Admin Log Module

CVE-2024-43444

What is CVE-2024-43444?

The OTRS admin log module contains a significant security flaw where passwords for both agents and customers can be exposed in plain text. This vulnerability arises when specific configurations related to authentication sources are set and debugging for the authentication backend is enabled. The affected versions of OTRS span from 7.0.X through 7.0.50, as well as OTRS 8.0.X, OTRS 2023.X, and OTRS from 2024.X through 2024.5.X. Additionally, products based on the ((OTRS)) Community Edition are also likely susceptible to this issue, raising significant concerns regarding data security and user confidentiality.

References