Description (CNA)
Specially crafted string in OTRS system configuration can allow the execution of any system command.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| OTRS AG / OTRS | affected 8.0.x through 8.0.19; affected 7.0.x through 7.0.32 |
| OTRS AG / SystemMonitoring | affected 7.0.x through 7.0.18; affected 8.0.x through 8.0.8; affected 6.0.1 before 6.0.x* |
| OTRS AG / OTRSSTORM | affected 7.0.x through 7.0.27; affected 8.0.x through 8.0.11; affected 6.0.1 before 6.0.x* |
| OTRS AG / ((OTRS)) Community Edition | affected 6.0.1 before 6.0.x* |
CWE
No CWE identifiers supplied.
References
- https://otrs.com/release-notes/otrs-security-advisory-2022-03/
- https://lists.debian.org/debian-lts-announce/2023/08/msg00040.html
ADP enrichment
No English description supplied.