CVE-2024-43445 Missing X-Content-Type-Options: nosniff Header Allows MIME Type Sniffing

A vulnerability exists in OTRS and OTRS Community Edition that fail to set the HTTP response header X-Content-Type-Options to nosniff. An attacker could exploit this vulnerability by uploading or inserting content that would be treated as a different MIME type than intended. This issue affects:...

CVE-2024-43445 Missing X-Content-Type-Options: nosniff Header Allows MIME Type Sniffing

A vulnerability exists in OTRS and OTRS Community Edition that fail to set the HTTP response header X-Content-Type-Options to nosniff. An attacker could exploit this vulnerability by uploading or inserting content that would be treated as a different MIME type than intended. This issue affects:...

CVE-2024-43445

CVE-2024-43445 affects OTRS and OTRS Community Edition, where HTTP responses may omit the X-Content-Type-Options: nosniff header. This allows MIME type confusion when uploading or inserting content. Affected: OTRS 7.0.x, 8.0.x, 2023.x, 2024.x and OTRS Community Edition 6.0.x (and related products...

OTRS 安全漏洞

OTRS is a service management solution from the German company OTRS. A security vulnerability exists in OTRS that stems from a rights management vulnerability in the OTRS Common Interface Module that allows the Ticket status to be changed even if the user only has ro privileges...

CVE-2024-43444

Passwords of agents and customers are displayed in plain text in the OTRS admin log module if certain configurations regarding the authentication sources match and debugging for the authentication backend has been enabled. This issue affects: OTRS from 7.0.X through 7.0.50 OTRS 8.0.X OTRS 2023.X...

CVE-2024-43442

Improper Neutralization of Input done by an attacker with admin privileges 'Cross-site Scripting' in OTRS System Configuration modules and OTRS Community Edition allows Cross-Site Scripting XSS within the System Configuration targeting other admins. This issue affects: OTRS from 7.0.X through...

CVE-2024-43443

Improper Neutralization of Input done by an attacker with admin privileges 'Cross-site Scripting' in Process Management modules of OTRS and OTRS Community Edition allows Cross-Site Scripting XSS within the Process Management targeting other admins. This issue affects: OTRS from 7.0.X through 7.0....

CVE-2024-43444

Passwords of agents and customers are displayed in plain text in the OTRS admin log module if certain configurations regarding the authentication sources match and debugging for the authentication backend has been enabled. This issue affects: OTRS from 7.0.X through 7.0.50 OTRS 8.0.X OTRS 2023.X...

CVE-2024-43442

Improper Neutralization of Input done by an attacker with admin privileges 'Cross-site Scripting' in OTRS System Configuration modules and OTRS Community Edition allows Cross-Site Scripting XSS within the System Configuration targeting other admins. This issue affects: OTRS from 7.0.X through...

CVE-2024-43443

Improper Neutralization of Input done by an attacker with admin privileges 'Cross-site Scripting' in Process Management modules of OTRS and OTRS Community Edition allows Cross-Site Scripting XSS within the Process Management targeting other admins. This issue affects: OTRS from 7.0.X through 7.0....

CVE-2024-43444 Passwords are written to Admin Log Module

Passwords of agents and customers are displayed in plain text in the OTRS admin log module if certain configurations regarding the authentication sources match and debugging for the authentication backend has been enabled. This issue affects: OTRS from 7.0.X through 7.0.50 OTRS 8.0.X OTRS 2023.X...

CVE-2024-43444 Passwords are written to Admin Log Module

Passwords of agents and customers are displayed in plain text in the OTRS admin log module if certain configurations regarding the authentication sources match and debugging for the authentication backend has been enabled. This issue affects: OTRS from 7.0.X through 7.0.50 OTRS 8.0.X OTRS 2023.X...

CVE-2024-43444

CVE-2024-43444 involves passwords of agents and customers being displayed in plain text in the OTRS admin log module when certain authentication source configurations are set and debugging for the authentication backend is enabled. Affected products include OTRS 7.0.X (up to 7.0.50), OTRS 8.0.X, ...

CVE-2024-43443 Stored XSS in process management

Improper Neutralization of Input done by an attacker with admin privileges 'Cross-site Scripting' in Process Management modules of OTRS and OTRS Community Edition allows Cross-Site Scripting XSS within the Process Management targeting other admins. This issue affects: OTRS from 7.0.X through 7.0....

CVE-2024-43443 Stored XSS in process management

Improper Neutralization of Input done by an attacker with admin privileges 'Cross-site Scripting' in Process Management modules of OTRS and OTRS Community Edition allows Cross-Site Scripting XSS within the Process Management targeting other admins. This issue affects: OTRS from 7.0.X through 7.0....

CVE-2024-43443

CVE-2024-43443 is a cross-site scripting (XSS) vulnerability in OTRS/((OTRS)) Community Edition’s Process Management module caused by improper input neutralization by an admin. Affected versions include OTRS 7.0.X–7.0.50, 8.0.X, 2023.X, 2024.X–2024.5.X, and ((OTRS)) Community Edition 6.0.x. The i...

CVE-2024-43442

CVE-2024-43442 describes a Cross-Site Scripting (XSS) vulnerability in OTRS/System Configuration where an attacker with admin privileges can target other admins due to improper input neutralization. Affected versions include OTRS 7.0.X–7.0.50, 8.0.X, 2023.X, 2024.X–2024.5.X, and ((OTRS)) Communit...

CVE-2024-43442 Stored XSS in System Configuration

Improper Neutralization of Input done by an attacker with admin privileges 'Cross-site Scripting' in OTRS System Configuration modules and OTRS Community Edition allows Cross-Site Scripting XSS within the System Configuration targeting other admins. This issue affects: OTRS from 7.0.X through...

CVE-2024-43442 Stored XSS in System Configuration

Improper Neutralization of Input done by an attacker with admin privileges 'Cross-site Scripting' in OTRS System Configuration modules and OTRS Community Edition allows Cross-Site Scripting XSS within the System Configuration targeting other admins. This issue affects: OTRS from 7.0.X through...

OTRS 安全漏洞

OTRS is a service management solution from OTRS Germany. A security vulnerability exists in OTRS that stems from agent and customer passwords being displayed in plain text in the OTRS Management Log module. The affected versions are as follows: OTRS versions 7.0.X through 7.0.50, OTRS version...