Release Note
OTRS Security Advisory 2024-05
Please read carefully and check if the version of your OTRS system is affected by this vulnerability.
Please send information regarding vulnerabilities in OTRS to: security@otrs.org
PGP Key
- pub 2048R/9C227C6B 2011-03-21
- uid OTRS Security Team <security@otrs.org>
- GPG Fingerprint E330 4608 DA6E 34B7 1551 C244 7F9E 44E9 9C22 7C6B
Security Advisory Details
- ID: OSA-2024-05
- Date: 2024-06-03
- Title: Possible remote code execution in uploaded filenames
- Severity (CVSS v3.1): 6.3 MEDIUM
- Severity (CVSS v4.0): 6.8 MEDIUM
- Urgency: Moderate
- Products: OTRS, ((OTRS)) Community Edition
- Fixed in: OTRS 7.0.50, OTRS 2024.4.3
- CVSS VECTORs: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:L / CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/U:Amber
- References: CVE-2024-23793
Upload of files outside application directory
The file upload feature in OTRS and ((OTRS)) Community Edition has a path traversal vulnerability. This issue permits authenticated agents or customer users to upload potentially harmful files to directories accessible by the web server, potentially leading to the execution of local code like Perl scripts.
PRODUCT AFFECTED:
This issue affects
OTRS:
- from 7.0.X through 7.0.49
- 8.0.X
- 2023.X
- from 2024.X through 2024.3.2
((OTRS)) Community Edition:
- from 6.0.1 through 6.0.34.
PROBLEM:
CWE-22 Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’) CWE-22
Product Status
| Product | Affected |
| OTRS AG OTRS » » File Upload
Default status is affected |
from 7.0.x through 7.0.49
8.0.x 2023.x from 2024.x through 2024.3.2 |
| OTRS AG ((OTRS)) Community Edition
Default status is affected |
from 6.0.1 through 6.0.34 |
SOLUTION:
Update to OTRS 2024.4.3 or OTRS 7.0.50 (extended support only)
ACKNOWLEDGEMENTS:
—