// For flags

CVE-2024-23790

Missing file type check in avatar picture upload

Severity Score

9.8
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

Improper Input Validation vulnerability in the upload functionality for user avatars allows functionality misuse due to missing check of filetypes.
This issue affects OTRS: from 7.0.X through 7.0.48, from 8.0.X through 8.0.37, from 2023 through 2023.1.1.

Una vulnerabilidad de validación de entrada incorrecta en la funcionalidad de carga de avatares de usuarios permite un mal uso de la funcionalidad debido a la falta de verificación de los tipos de archivos. Este problema afecta a OTRS: desde 7.0.X hasta 7.0.48, desde 8.0.X hasta 8.0.37, desde 2023 hasta 2023.1.1.

*Credits: Special thanks to Matthias Püschel for reporting these vulnerability.
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
Required
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2024-01-22 CVE Reserved
  • 2024-01-29 CVE Published
  • 2024-03-01 EPSS Updated
  • 2024-08-01 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-20: Improper Input Validation
  • CWE-354: Improper Validation of Integrity Check Value
CAPEC
  • CAPEC-212: Functionality Misuse
References (1)
URL Tag Source
URL Date SRC
URL Date SRC
URL Date SRC
https://otrs.com/release-notes/otrs-security-advisory-2024-01 2024-02-02
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Otrs
Search vendor "Otrs"
 Otrs
Search vendor "Otrs" for product "Otrs"
 >= 7.0.0 < 7.0.49
Search vendor "Otrs" for product "Otrs" and version " >= 7.0.0 < 7.0.49"
-
Affected
Otrs
Search vendor "Otrs"
 Otrs
Search vendor "Otrs" for product "Otrs"
 >= 8.0.0 < 2024.1.1
Search vendor "Otrs" for product "Otrs" and version " >= 8.0.0 < 2024.1.1"
-
Affected