CVE-2023-38056 — Code execution via System Configuration

Description (CNA)

Improper Neutralization of commands allowed to be executed via OTRS System Configuration e.g. SchedulerCronTaskModule using UnitTests modules allows any authenticated attacker with admin privileges local execution of Code.This issue affects OTRS: from 7.0.X before 7.0.45, from 8.0.X before 8.0.35; ((OTRS)) Community Edition: from 6.0.1 through 6.0.34.

Affected (CNA)

Vendor / product	Versions
OTRS AG / OTRS	affected 7.0.x before 7.0.45; affected 8.0.x before 8.0.35
OTRS AG / ((OTRS)) Community Edition	affected 6.0.1 through 6.0.34

CWE

CWE-78

References

https://otrs.com/release-notes/otrs-security-advisory-2023-05/

ADP enrichment

CVE

No English description supplied.

https://otrs.com/release-notes/otrs-security-advisory-2023-05/

CISA-ADP

No English description supplied.

No references supplied.