Log Information Disclosure in OTRS by OTRS AG
CVE-2025-24389

6.3MEDIUM

Key Information:

Vendor

Otrs Ag

Status
Otrs
((otrs)) Community Edition
Vendor
CVE Published:
27 January 2025

What is CVE-2025-24389?

A vulnerability in OTRS and the ((OTRS)) Community Edition allows sensitive information to be logged improperly, which can be sent to system administrators via email. This issue arises from certain errors in upstream libraries, potentially exposing confidential data. The affected versions include OTRS 7.0.X, 8.0.X, 2023.X, 2024.X, and the Community Edition 6.0.x, along with other products based on the Community Edition.

Affected Version(s)

((OTRS)) Community Edition 6.0.x <= 6.0.34

OTRS 7.0.x

OTRS 7.0.x

References

https://otrs.com/release-notes/otrs-security-advisory-202...

CVSS V3.1

Score:
6.3
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.