CVE-2018-17883: Improper Neutralization of Input During Web Page Generation

An issue was discovered in Open Ticket Request System OTRS 6.0.x before 6.0.12. An attacker could send an e-mail message with a malicious link to an OTRS system or an agent. If a logged-in agent opens this link, it could cause the execution of JavaScript in the context of OTRS...

PT-2023-10709

Name of the Vulnerable Software and Affected Versions Open Ticket Request System OTRS versions 6.0.x through 6.0.11 Description An issue was discovered in Open Ticket Request System OTRS where an attacker could send an e-mail message with a malicious link to an OTRS system or an agent. If a...

CVE-2013-4717: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in Open Ticket Request System OTRS Help Desk 3.0.x before 3.0.22, 3.1.x before 3.1.18, and 3.2.x before 3.2.9 allow remote authenticated users to execute arbitrary SQL commands via unspecified vectors related to Kernel/Output/HTML/PreferencesCustomQueue.pm,...

CVE-2019-16375: Improper Neutralization of Input During Web Page Generation

An issue was discovered in Open Ticket Request System OTRS 7.0.x through 7.0.11, and Community Edition 5.0.x through 5.0.37 and 6.0.x through 6.0.22. An attacker who is logged in as an agent or customer user with appropriate permissions can create a carefully crafted string containing malicious...

CVE-2019-10065: Undefined Security Weakness

An issue was discovered in Open Ticket Request System OTRS 7.0 through 7.0.6. An attacker who is logged into OTRS as a customer user can use the search result screens to disclose information from internal FAQ articles, a different vulnerability than CVE-2019-9753...

CVE-2019-13457: Exposure of Sensitive Information to an Unauthorized Actor

An issue was discovered in Open Ticket Request System OTRS 7.0.x through 7.0.8. A customer user can use the search results to disclose information from their "company" tickets with the same CustomerID, even when the CustomerDisableCompanyTicketAccess setting is turned on...

CVE-2019-18179: Undefined Security Weakness

An issue was discovered in Open Ticket Request System OTRS 7.0.x through 7.0.12, and Community Edition 5.0.x through 5.0.38 and 6.0.x through 6.0.23. An attacker who is logged into OTRS as an agent is able to list tickets assigned to other agents, even tickets in a queue where the attacker doesn'...

CVE-2019-13458: Undefined Security Weakness

An issue was discovered in Open Ticket Request System OTRS 7.0.x through 7.0.8, and Community Edition 5.0.x through 5.0.36 and 6.0.x through 6.0.19. An attacker who is logged into OTRS as an agent user with appropriate permissions can leverage OTRS notification tags in templates in order to...

CVE-2019-12248: Undefined Security Weakness

An issue was discovered in Open Ticket Request System OTRS 7.0.x through 7.0.7, Community Edition 6.0.x through 6.0.19, and Community Edition 5.0.x through 5.0.36. An attacker could send a malicious email to an OTRS system. If a logged-in agent user quotes it, the email could cause the browser to...

CVE-2019-12497: Exposure of Sensitive Information to an Unauthorized Actor

An issue was discovered in Open Ticket Request System OTRS 7.0.x through 7.0.8, Community Edition 6.0.x through 6.0.19, and Community Edition 5.0.x through 5.0.36. In the customer or external frontend, personal information of agents e.g., Name and mail address can be disclosed in external notes...

CVE-2019-10067: Improper Neutralization of Input During Web Page Generation

An issue was discovered in Open Ticket Request System OTRS 7.x through 7.0.6 and Community Edition 5.0.x through 5.0.35 and 6.0.x through 6.0.17. An attacker who is logged into OTRS as an agent user with appropriate permissions may manipulate the URL to cause execution of JavaScript in the contex...

CVE-2019-9892: XML Injection (aka Blind XPath Injection)

An issue was discovered in Open Ticket Request System OTRS 5.x through 5.0.34, 6.x through 6.0.17, and 7.x through 7.0.6. An attacker who is logged into OTRS as an agent user with appropriate permissions may try to import carefully crafted Report Statistics XML that will result in reading of...

PT-2019-19844

Name of the Vulnerable Software and Affected Versions Open Ticket Request System OTRS versions 5.x through 5.0.33 Open Ticket Request System OTRS versions 6.x through 6.0.15 Open Ticket Request System OTRS versions 7.x through 7.0.3 Description An issue was discovered in Open Ticket Request Syste...

PT-2019-19843

Name of the Vulnerable Software and Affected Versions Open Ticket Request System OTRS versions 6.x through 6.0.16 Open Ticket Request System OTRS versions 7.x through 7.0.4 Description An issue in OTRS allows an attacker who is logged in as an admin user to manipulate the URL and cause execution ...

CVE-2019-9751: Improper Neutralization of Input During Web Page Generation

An issue was discovered in Open Ticket Request System OTRS 6.x before 6.0.17 and 7.x before 7.0.5. An attacker who is logged into OTRS as an admin user may manipulate the URL to cause execution of JavaScript in the context of OTRS. This is related to Kernel/Output/Template/Document.pm...

CVE-2018-19142: Improper Neutralization of Input During Web Page Generation

Open Ticket Request System OTRS 6.0.x before 6.0.13 allows an admin to conduct an XSS attack via a modified URL...

CVE-2018-19143: Direct Request

Open Ticket Request System OTRS 4.0.x before 4.0.33, 5.0.x before 5.0.31, and 6.0.x before 6.0.13 allows an authenticated user to delete files via a modified submission form because upload caching is mishandled...

CVE-2018-19141: Improper Neutralization of Input During Web Page Generation

Open Ticket Request System OTRS 4.0.x before 4.0.33 and 5.0.x before 5.0.31 allows an admin to conduct an XSS attack via a modified URL because user and customer preferences are mishandled...

PT-2018-14831

Name of the Vulnerable Software and Affected Versions Open Ticket Request System OTRS versions 4.0.x through 4.0.32 Open Ticket Request System OTRS versions 5.0.x through 5.0.30 Description The issue allows an admin to conduct a cross-site scripting XSS attack via a modified URL. This is due to t...

PT-2018-14833

Name of the Vulnerable Software and Affected Versions Open Ticket Request System OTRS versions 4.0.x through 4.0.32 Open Ticket Request System OTRS versions 5.0.x through 5.0.30 Open Ticket Request System OTRS versions 6.0.x through 6.0.12 Description The issue allows an authenticated user to...