CVE-2024-23792

When adding attachments to ticket comments, another user can add attachments as well impersonating the orginal user. The attack requires a logged-in other user to know the UUID. While the legitimate user completes the comment, the malicious user can add more files to the comment. This issue affects OTRS: from 7.0.X through 7.0.48, from 8.0.X through 8.0.37, from 2023.X through 2023.1.1.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.6 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://otrs.com/release-notes/otrs-security-advisory-2024-03/	Vendor Advisory
https://otrs.com/release-notes/otrs-security-advisory-2024-03/	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:otrs:otrs::::::::
	cpe:2.3:a:otrs:otrs::::::::

History

21 Nov 2024, 08:58

Type	Values Removed	Values Added
References	~~() https://otrs.com/release-notes/otrs-security-advisory-2024-03/ - Vendor Advisory~~	() https://otrs.com/release-notes/otrs-security-advisory-2024-03/ - Vendor Advisory
CVSS	v2 : ~~unknown~~ v3 : ~~6.5~~	v2 : unknown v3 : 5.3

02 Feb 2024, 02:07

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 6.5
First Time		Otrs otrs Otrs
CWE		CWE-287
References	~~() https://otrs.com/release-notes/otrs-security-advisory-2024-03/ -~~	() https://otrs.com/release-notes/otrs-security-advisory-2024-03/ - Vendor Advisory
CPE		cpe:2.3:a:otrs:otrs::::::::

29 Jan 2024, 10:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-01-29 10:15

Updated : 2024-11-21 08:58

NVD link : CVE-2024-23792

Mitre link : CVE-2024-23792

CVE.ORG link : CVE-2024-23792

JSON object : View

Products Affected

otrs

otrs

CWE

CWE-287

Improper Authentication

{"id": "CVE-2024-23792", "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security@otrs.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.6}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "published": "2024-01-29T10:15:08.683", "references": [{"url": "https://otrs.com/release-notes/otrs-security-advisory-2024-03/", "tags": ["Vendor Advisory"], "source": "security@otrs.com"}, {"url": "https://otrs.com/release-notes/otrs-security-advisory-2024-03/", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "security@otrs.com", "description": [{"lang": "en", "value": "CWE-287"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-287"}]}], "descriptions": [{"lang": "en", "value": "When adding attachments to ticket comments, \nanother user can add attachments as well impersonating the orginal user. The attack requires a \nlogged-in other user to know the UUID. While the legitimate user \ncompletes the comment, the malicious user can add more files to the \ncomment.\n\nThis issue affects OTRS: from 7.0.X through 7.0.48, from 8.0.X through 8.0.37, from 2023.X through 2023.1.1.\n\n"}, {"lang": "es", "value": "Al agregar archivos adjuntos a los comentarios del ticket, otro usuario puede agregar archivos adjuntos y hacerse pasar por el usuario original. El ataque requiere que otro usuario que haya iniciado sesi\u00f3n conozca el UUID. Mientras el usuario leg\u00edtimo completa el comentario, el usuario malintencionado puede agregar m\u00e1s archivos al comentario. Este problema afecta a OTRS: desde 7.0.X hasta 7.0.48, desde 8.0.X hasta 8.0.37, desde 2023.X hasta 2023.1.1."}], "lastModified": "2024-11-21T08:58:25.700", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:otrs:otrs:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4E47E75A-C9A9-40EE-A5DE-B4CDD98E7B7F", "versionEndExcluding": "7.0.49", "versionStartIncluding": "7.0.0"}, {"criteria": "cpe:2.3:a:otrs:otrs:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3B9B2075-4C3E-48C9-96DA-655E4F29325A", "versionEndExcluding": "2024.1.1", "versionStartIncluding": "8.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@otrs.com"}