Release Note

OTRS Security Advisory 2024-12

Please read carefully and check if the version of your OTRS system is affected by this vulnerability.

Please send information regarding vulnerabilities in OTRS to: security@otrs.org

PGP Key

pub 2048R/9C227C6B 2011-03-21
uid OTRS Security Team <security@otrs.org>
GPG Fingerprint E330 4608 DA6E 34B7 1551 C244 7F9E 44E9 9C22 7C6B

Security Advisory Details

ID: OSA-2024-12
Date: 2024-08-26
Title: Passwords are written to Admin Log Module
Severity CVSS v3.1: 8.2 HIGH
Severity CVSS v4.0: 8.6 HIGH
Urgency: LOW
Product: OTRS, ((OTRS)) Community Edition
Fixed in: OTRS 2024.6.1 and OTRS 7.0.51
CVSS VECTOR:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N * CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/R:A/V:D/RE:L/U:Amber
References: CVE-2024-43444

Passwords are written to Admin Log Module

Passwords of agents and customers are displayed in plain text in the OTRS admin log module if certain configurations regarding the authentication sources match and debugging for the authentication backend has been enabled

PRODUCT AFFECTED:

This issue affects

OTRS:

from 7.0.X through 7.0.50
8.0.X
2023.X
from 2024.X through 2024.5.X

((OTRS)) Community Edition:

6.0.x

Products based on the ((OTRS)) Community Edition also very likely to be affected.

Problem:

CWE-532 Insertion of Sensitive Information into Log File CWE-532

Impact:

CAPEC-545 Pull Data from System Resources CAPEC-545

Product Status

Product

Affected

OTRS AG OTRS » System Configuration

Default status is unaffected

from 7.0.x through 7.0.50
8.0.x
2023.x
from 2024.x through 2024.5.x

OTRS AG ((OTRS)) Community Edition » System Configuration

Default status is affected

6.0.x

SOLUTION:

Update to OTRS 2024.6.x or OTRS 7.0.51