Release Note

OTRS Security Advisory 2023-04

Please read carefully and check if the version of your OTRS system is affected by this vulnerability.

Please send information regarding vulnerabilities in OTRS to: security@otrs.org

PGP Key

pub 2048R/9C227C6B 2011-03-21
uid OTRS Security Team <security@otrs.org>
GPG Fingerprint E330 4608 DA6E 34B7 1551 C244 7F9E 44E9 9C22 7C6B

Security Advisory Details

ID: OSA-2023-04
Date: 2023-07-24
Title: Host header injection by attachments in web service
Severity: 6.3 MEDIUM
Product: ((OTRS)) Community Edition 6.0.x, OTRS 7.0.x, OTRS 8.0.x
Fixed in: OTRS 7.0.45, OTRS 8.0.35
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
References: CVE-2023-38060

OSA-2023-04 Host header injection by attachments in web service

Improper Input Validation vulnerability in the ContentType parameter for attachments on TicketCreate or TicketUpdate operations of the OTRS Generic Interface modules allows any authenticated attacker to to perform an host header injection for the ContentType header of the attachment.

PRODUCT AFFECTED:

This issue affects

OTRS: from 7.0.X before 7.0.45, from 8.0.X before 8.0.35

((OTRS)) Community Edition: from 6.0.1 through 6.0.34

PROBLEM:

CWE-20 Improper Input Validation CWE-20

Impact:

CAPEC-141 Cache Poisoning CAPEC-141

Product Status

Product

Affected

OTRS AG OTRS » Generic Interface

Default status is affected

from 7.0.x before 7.0.45

from 8.0.x before 8.0.35

OTRS AG ((OTRS)) Community Edition » Generic Interface

Default status is affected

from 6.0.1 through 6.0.34

SOLUTION:

Update to OTRS 8.0.35 or OTRS 7.0.45

MODIFICATION HISTORY:

CVSS SCORE:

3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

RISK LEVEL:

MEDIUM

ACKNOWLEDGEMENTS:

Special thanks to Tim Püttmanns for reporting these vulnerability.