CVE-2023-1250 — Code execution through ACL creation

Description (CNA)

Improper Input Validation vulnerability in OTRS AG OTRS (ACL modules), OTRS AG ((OTRS)) Community Edition (ACL modules) allows Local Execution of Code. When creating/importing an ACL it was possible to inject code that gets executed via manipulated comments and ACL-names This issue affects OTRS: from 7.0.X before 7.0.42, from 8.0.X before 8.0.31; ((OTRS)) Community Edition: from 6.0.1 through 6.0.34.

Affected (CNA)

Vendor / product	Versions
OTRS AG / OTRS	affected 7.0.x before 7.0.42; affected 8.0.x before 8.0.31
OTRS AG / ((OTRS)) Community Edition	affected 6.0.1 through 6.0.34

CWE

CWE-20

References

https://otrs.com/release-notes/otrs-security-advisory-2023-02/

ADP enrichment

CVE

No English description supplied.

https://otrs.com/release-notes/otrs-security-advisory-2023-02/

CISA-ADP

No English description supplied.

No references supplied.