CVSS: 9.0EPSS: 0%CPEs: 6EXPL: 0CVE-2021-36100 – Authenticated remote code execution
https://notcve.org/view.php?id=CVE-2021-36100
Specially crafted string in OTRS system configuration can allow the execution of any system command. Una cadena especialmente diseñada en la configuración del sistema OTRS puede permitir la ejecución de cualquier comando del sistema • https://lists.debian.org/debian-lts-announce/2023/08/msg00040.html https://otrs.com/release-notes/otrs-security-advisory-2022-03 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2020-1778 – Bypassing user account validation
https://notcve.org/view.php?id=CVE-2020-1778
When OTRS uses multiple backends for user authentication (with LDAP), agents are able to login even if the account is set to invalid. This issue affects OTRS; 8.0.9 and prior versions. Cuando OTRS usa múltiples backends para la autenticación de usuarios (con LDAP), unos agentes pueden iniciar sesión incluso si la cuenta está ajustada como no válida. Este problema afecta a OTRS; versiones 8.0.9 y anteriores • https://otrs.com/release-notes/otrs-security-advisory-2020-16 • CWE-287: Improper Authentication •
CVSS: 4.3EPSS: 0%CPEs: 3EXPL: 0CVE-2020-1776 – Invalidating or changing user does not invalidate session
https://notcve.org/view.php?id=CVE-2020-1776
When an agent user is renamed or set to invalid the session belonging to the user is keept active. The session can not be used to access ticket data in the case the agent is invalid. This issue affects ((OTRS)) Community Edition: 6.0.28 and prior versions. OTRS: 7.0.18 and prior versions, 8.0.4. and prior versions. Cuando un usuario de agente es renombrado o se establece como no válido, la sesión que pertenece al usuario se mantiene activa. • https://lists.debian.org/debian-lts-announce/2023/08/msg00040.html https://otrs.com/release-notes/otrs-security-advisory-2020-13 • CWE-613: Insufficient Session Expiration •
CVSS: 4.3EPSS: 0%CPEs: 54EXPL: 3CVE-2012-4751 – OTRS 3.1 - Persistent Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2012-4751
Cross-site scripting (XSS) vulnerability in Open Ticket Request System (OTRS) Help Desk 2.4.x before 2.4.15, 3.0.x before 3.0.17, and 3.1.x before 3.1.11 allows remote attackers to inject arbitrary web script or HTML via an e-mail message body with whitespace before a javascript: URL in the SRC attribute of an element, as demonstrated by an IFRAME element. Vulnerabilidad de ejecución de secuencias de comandos en sitios cruzados (XSS) en Open Ticket Request System (OTRS) Help Desk v2.4.x antes de v2.4.15, v3.0.x antes v3.0.17, y v3.1.x antes de v3.1.11 permite a atacantes remotos inyectar secuencias de comandos web o HTML a través de un cuerpo de mensaje de correo electrónico con un espacio en blanco antes de un javascript: URL en el atributo SRC de un elemento, como lo demuestra un elemento IFRAME. OTRS version 3.1 suffers from a stored cross site scripting vulnerability. • https://www.exploit-db.com/exploits/22070 https://www.exploit-db.com/exploits/20959 http://lists.opensuse.org/opensuse-updates/2013-01/msg00036.html http://packetstormsecurity.org/files/117504/OTRS-3.1-Cross-Site-Scripting.html http://www.kb.cert.org/vuls/id/603276 http://www.otrs.com/en/open-source/community-news/security-advisories/security-advisory-2012-03 http://www.securityfocus.com/bid/56093 http://znuny.com/assets/proof_of_concept_cve_2012-4751-znuny.py http://znun • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 2.6EPSS: 0%CPEs: 58EXPL: 3CVE-2012-4600 – OTRS 3.1 - Persistent Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2012-4600
Cross-site scripting (XSS) vulnerability in Open Ticket Request System (OTRS) Help Desk 2.4.x before 2.4.14, 3.0.x before 3.0.16, and 3.1.x before 3.1.10, when Firefox or Opera is used, allows remote attackers to inject arbitrary web script or HTML via an e-mail message body with nested HTML tags. Una vulnerabilidad de ejecución de comandos en sitios cruzados (XSS) en Open System Request Ticket (OTRS) Help Desk v2.4.x antes de v2.4.14, v3.0.x antes de v3.0.16, y v3.1.x antes de v3.1.10, cuando se usa Firefox u Opera, permite a atacantes remotos inyectar secuencias de comandos web o HTML a través de un cuerpo de mensaje de correo electrónico con etiquetas HTML anidadas. OTRS Open Technology Real Services versions 3.1.8 and 3.1.9 suffer from a cross site scripting vulnerability. • https://www.exploit-db.com/exploits/22070 https://www.exploit-db.com/exploits/20959 http://secunia.com/advisories/50615 http://www.kb.cert.org/vuls/id/511404 http://www.otrs.com/de/open-source/community-news/security-advisories/security-advisory-2012-02 http://znuny.com/en/#%21/advisory/ZSA-2012-02 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •