Lucene search

K
suseSuseOPENSUSE-SU-2018:4046-1
HistoryDec 08, 2018 - 12:23 a.m.

Security update for otrs (moderate)

2018-12-0800:23:24
lists.opensuse.org
64

EPSS

0.001

Percentile

18.7%

This update for otrs fixes the following issues:

Update to version 4.0.33.

Security issues fixed:

  • CVE-2018-19141: Fixed privilege escalation, that an attacker who is
    logged into OTRS as an admin user cannot manipulate the URL to cause
    execution of JavaScript in the context of OTRS.
  • CVE-2018-19143: Fixed remote file deletion, that an attacker who is
    logged into OTRS as a user cannot manipulate the submission form to
    cause deletion of arbitrary files that the OTRS web server user has
    write access to.

Non-security issues fixed:

EPSS

0.001

Percentile

18.7%