Release Note

OTRS Security Advisory 2023-08

Please read carefully and check if the version of your OTRS system is affected by this vulnerability.

Please send information regarding vulnerabilities in OTRS to: security@otrs.org

PGP Key

pub 2048R/9C227C6B 2011-03-21
uid OTRS Security Team <security@otrs.org>
GPG Fingerprint E330 4608 DA6E 34B7 1551 C244 7F9E 44E9 9C22 7C6B

Security Advisory Details

ID: OSA-2023-08
Date: 2023-10-16
Title: External pictures can be loaded even if not allowed by configuration
Severity: 5.3 MEDIUM
Product: OTRS 7.0.x, OTRS 8.0.x
Fixed in: OTRS 7.0.47, OTRS 8.0.37
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
References: CVE-2023-38059

OSA-2023-08 External pictures can be loaded even if not allowed by configuration (CVE-2023-38059)

The loading of external images is not blocked, even if configured, if the attacker uses protocol-relative URL in the payload. This can be used to retreive the IP of the user.

PRODUCT AFFECTED:

OTRS: from 7.0.X before 7.0.47,
OTRS: from 8.0.X before 8.0.37
((OTRS)) Community Edition: from 6.0.X through 6.0.34.

PROBLEM:

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor CWE-200

Impact:

CAPEC-37 Retrieve Embedded Sensitive Data CAPEC-37

Product Status

Product

Affected

OTRS AG OTRS » Agent interface

Default status is affected

from 7.0.x before 7.0.47

from 8.0.x before 8.0.37

OTRS AG ((OTRS)) Community Edition » Agent Interface

Default status is affected

from 6.0.x through 6.0.34

SOLUTION:

Update to OTRS 8.0.37 or OTRS 7.0.47

MODIFICATION HISTORY:

CVSS SCORE:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

RISK LEVEL:

LOW

ACKNOWLEDGEMENTS:

Special thanks to Tim Püttmanns for reporting these vulnerability.