Otrs
69 CVEs across 15 Otrs products. Browse Otrs vulnerabilities, severities, and proof-of-concept exploits.
Otrs products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-48209 | High | 7.1 | 2026-06-01 | An improper neutralization of user-controllable input in OTRS or ((OTRS)) Community Edition ticket handling allows authenticated attackers to perform reflected… |
CVE-2026-48208 | Medium | 6.5 | 2026-06-01 | An improper neutralization of active SVG content in OTRS or ((OTRS)) Community Edition ticket article rendering allows attackers to inject specially crafted SV… |
CVE-2026-48191 | Low | 3.5 | 2026-06-01 | An incorrect handling of permissions in STORM powered by OTRS and in OTRS (2026.x and above) Document Search Article Meta Filters modules allows gaining knowle… |
CVE-2026-48190 | Low | 3.5 | 2026-06-01 | An incorrect handling of permissions in OTRS External Interface and the ConfigItem List module allows an authenticated customer to query the system for CI info… |
CVE-2026-48189 | Medium | 5.7 | 2026-06-01 | An improper Input Validation vulnerability in OTRS Customer Backend module allows to access customer information which are restricted to other groups. Please n… |
CVE-2026-48188 | Critical | 9.1 | 2026-06-01 | An improper Input Validation vulnerability in OTRS or ((OTRS)) Community Edition database layer module allows an unauthenticated SQL injection which can lead t… |
CVE-2026-48187 | Medium | 5.7 | 2026-06-01 | An uncontrolled allocation of resources without limits or throttling in the e-mail handling in OTRS allows excessive allocation which may lead to the abortion… |
CVE-2026-48210 | Medium | 5.7 | 2026-05-31 | An improper default configuration in OTRS 2026.3.1 causes ticket article forwarding actions to enforce the “Is visible for customer” flag by default and preven… |
CVE-2025-24387 | Medium | 4.8 | 2025-03-10 | A vulnerability in OTRS Application Server allows session hijacking due to missing attributes for sensitive cookie settings in HTTPS sessions. A request to an… |
CVE-2024-6540 | Medium | 5.7 | 2024-07-15 | Improper filtering of fields when using the export function in the ticket overview of the external interface in OTRS could allow an authorized user to download… |
CVE-2024-23794 | Medium | 5.2 | 2024-07-15 | An incorrect privilege assignment vulnerability in the inline editing functionality of OTRS can lead to privilege escalation. This flaw allows an agent with re… |
CVE-2024-23792 | Medium | 5.3 | 2024-01-29 | When adding attachments to ticket comments, another user can add attachments as well impersonating the orginal user. The attack requires a logged-in other us… |
CVE-2024-23791 | Medium | 4.9 | 2024-01-29 | Insertion of debug information into log file during building the elastic search index allows reading of sensitive information from articles.This issue affects… |
CVE-2024-23790 | Low | 3.5 | 2024-01-29 | Improper Input Validation vulnerability in the upload functionality for user avatars allows functionality misuse due to missing check of filetypes. This issue… |
CVE-2023-6254 | High | 8.1 | 2023-11-27 | A Vulnerability in OTRS AgentInterface and ExternalInterface allows the reading of plain text passwords which are send back to the client in the server respons… |
CVE-2023-5422 | High | 8.7 | 2023-10-16 | The functions to fetch e-mail via POP3 or IMAP as well as sending e-mail via SMTP use OpenSSL for static SSL or TLS based communication. As the SSL_get_verify… |
CVE-2023-5421 | Low | 3.5 | 2023-10-16 | An attacker who is logged into OTRS as an user with privileges to create and change customer user data may manipulate the CustomerID field to execute JavaScrip… |
CVE-2023-38059 | Medium | 5.3 | 2023-10-16 | The loading of external images is not blocked, even if configured, if the attacker uses protocol-relative URL in the payload. This can be used to retreive the… |
CVE-2023-38060 | Medium | 6.3 | 2023-07-24 | Improper Input Validation vulnerability in the ContentType parameter for attachments on TicketCreate or TicketUpdate operations of the OTRS Generic Interface m… |
CVE-2023-38058 | Medium | 4.1 | 2023-07-24 | An improper privilege check in the OTRS ticket move action in the agent interface allows any as agent authenticated attacker to to perform a move of an tick… |
CVE-2023-38057 | Medium | 4.1 | 2023-07-24 | An improper input validation vulnerability in OTRS Survey modules allows any attacker with a link to a valid and unanswered survey request to inject javascript… |
CVE-2023-38056 | High | 7.2 | 2023-07-24 | Improper Neutralization of commands allowed to be executed via OTRS System Configuration e.g. SchedulerCronTaskModule using UnitTests modules allows any authen… |
CVE-2023-2534 | High | 7.6 | 2023-05-08 | Improper Authorization vulnerability in OTRS AG OTRS 8 (Websocket API backend) allows any as Agent authenticated attacker to track user behaviour and to gain l… |
CVE-2018-17883 | Medium | 6.1 | 2023-04-16 | An issue was discovered in Open Ticket Request System (OTRS) 6.0.x before 6.0.12. An attacker could send an e-mail message with a malicious link to an OTRS sys… |
CVE-2023-1250 | High | 7.4 | 2023-03-20 | Improper Input Validation vulnerability in OTRS AG OTRS (ACL modules), OTRS AG ((OTRS)) Community Edition (ACL modules) allows Local Execution of Code. When cr… |
CVE-2023-1248 | Medium | 6.1 | 2023-03-20 | Improper Input Validation vulnerability in OTRS AG OTRS (Ticket Actions modules), OTRS AG ((OTRS)) Community Edition (Ticket Actions modules) allows Cross-Site… |
CVE-2022-4427 | Medium | 6.5 | 2022-12-19 | Improper Input Validation vulnerability in OTRS AG OTRS, OTRS AG ((OTRS)) Community Edition allows SQL Injection via TicketSearch Webservice This issue affects… |
CVE-2022-3501 | Low | 3.5 | 2022-10-17 | Article template contents with sensitive data could be accessed from agents without permissions. |
CVE-2022-39052 | High | 7.5 | 2022-10-17 | An external attacker is able to send a specially crafted email (with many recipients) and trigger a potential DoS of the system |
CVE-2022-39051 | Medium | 6.8 | 2022-09-05 | Attacker might be able to execute malicious Perl code in the Template toolkit, by having the admin installing an unverified 3th party package |
CVE-2022-39050 | Medium | 4.6 | 2022-09-05 | An attacker who is logged into OTRS as an admin user may manipulate customer URL field to store JavaScript code to be run later by any other agent when clickin… |
CVE-2022-39049 | Low | 3.5 | 2022-09-05 | An attacker who is logged into OTRS as an admin user may manipulate the URL to cause execution of JavaScript in the context of OTRS. |
CVE-2022-32741 | Medium | 5.3 | 2022-06-13 | Attacker is able to determine if the provided username exists (and it's valid) using Request New Password feature, based on the response time. |
CVE-2022-32740 | Low | 3.5 | 2022-06-13 | A reply to a forwarded email article by a 3rd party could unintensionally expose the email content to the ticket customer under certain circumstances. |
CVE-2022-32739 | Low | 3.5 | 2022-06-13 | When Secure::DisableBanner system configuration has been disabled and agent shares his calendar via public URL, received ICS file contains OTRS release number. |
CVE-2022-1004 | Medium | 4.3 | 2022-03-21 | Accounted time is shown in the Ticket Detail View (External Interface), even if ExternalFrontend::TicketDetailView###AccountedTimeDisplay is disabled. |
CVE-2022-0475 | Low | 3.5 | 2022-03-21 | Malicious translator is able to inject JavaScript code in few translatable strings (where HTML is allowed). The code could be executed in the Package manager… |
CVE-2021-36100 | Medium | 6.4 | 2022-03-21 | Specially crafted string in OTRS system configuration can allow the execution of any system command. |
CVE-2022-0474 | Low | 2.4 | 2022-02-07 | Full list of recipients from customer users in a contact field could be disclosed in notification emails event when the notification is set to be sent to each… |
CVE-2022-0473 | Low | 3.8 | 2022-02-07 | OTRS administrators can configure dynamic field and inject malicious JavaScript code in the error message of the regular expression check. When used in the age… |
CVE-2021-36097 | Low | 3.5 | 2021-10-18 | Agents are able to lock the ticket without the "Owner" permission. Once the ticket is locked, it could be moved to the queue where the agent has "rw" permissio… |
CVE-2021-36096 | Medium | 5.2 | 2021-09-06 | Generated Support Bundles contains private S/MIME and PGP keys if containing folder is not hidden. This issue affects: OTRS AG ((OTRS)) Community Edition 6.0.x… |
CVE-2021-36095 | Medium | 5.3 | 2021-09-06 | Malicious attacker is able to find out valid user logins by using the "lost password" feature. This issue affects: OTRS AG ((OTRS)) Community Edition version 6… |
CVE-2021-36094 | Medium | 5.7 | 2021-09-06 | It's possible to craft a request for appointment edit screen, which could lead to the XSS attack. This issue affects: OTRS AG ((OTRS)) Community Edition 6.0.x… |
CVE-2021-36093 | Medium | 5.3 | 2021-09-06 | It's possible to create an email which can be stuck while being processed by PostMaster filters, causing DoS. This issue affects: OTRS AG ((OTRS)) Community Ed… |
CVE-2013-4718 | Medium | 5.4 | 2021-08-09 | Cross-site scripting (XSS) vulnerability in Open Ticket Request System (OTRS) ITSM 3.0.x before 3.0.9, 3.1.x before 3.1.10, and 3.2.x before 3.2.7 allows remot… |
CVE-2013-4717 | High | 8.8 | 2021-08-09 | Multiple SQL injection vulnerabilities in Open Ticket Request System (OTRS) Help Desk 3.0.x before 3.0.22, 3.1.x before 3.1.18, and 3.2.x before 3.2.9 allow re… |
CVE-2021-36092 | Medium | 6.5 | 2021-07-26 | It's possible to create an email which contains specially crafted link and it can be used to perform XSS attack. This issue affects: OTRS AG ((OTRS)) Community… |
CVE-2021-36091 | Low | 3.5 | 2021-07-26 | Agents are able to list appointments in the calendars without required permissions. This issue affects: OTRS AG ((OTRS)) Community Edition: 6.0.x version 6.0.1… |
CVE-2021-21443 | Low | 3.5 | 2021-07-26 | Agents are able to list customer user emails without required permissions in the bulk action screen. This issue affects: OTRS AG ((OTRS)) Community Edition: 6… |
CVE-2021-21442 | Medium | 4.5 | 2021-07-26 | In the project create screen it's possible to inject malicious JS code to the certain fields. The code might be executed in the Reporting screen. This issue af… |
CVE-2021-21440 | Medium | 5.2 | 2021-07-26 | Generated Support Bundles contains private S/MIME and PGP keys if containing folder is not hidden. This issue affects: OTRS AG ((OTRS)) Community Edition 6.0.x… |
CVE-2021-21441 | High | 7.5 | 2021-06-16 | There is a XSS vulnerability in the ticket overview screens. It's possible to collect various information by having an e-mail shown in the overview screen. Att… |
CVE-2021-21439 | Medium | 6.5 | 2021-06-14 | DoS attack can be performed when an email contains specially designed URL in the body. It can lead to the high CPU usage and cause low quality of service, or i… |
CVE-2021-21438 | Low | 3.5 | 2021-03-22 | Agents are able to see linked FAQ articles without permissions (defined in FAQ Category). This issue affects: FAQ version 6.0.29 and prior versions, OTRS versi… |
CVE-2021-21437 | Low | 3.5 | 2021-03-22 | Agents are able to see linked Config Items without permissions, which are defined in General Catalog. This issue affects: OTRSCIsInCustomerFrontend 7.0.15 and… |
CVE-2021-21436 | Low | 3.5 | 2021-02-08 | Agents are able to see and link Config Items without permissions, which are defined in General Catalog. This issue affects: OTRS AG OTRSCIsInCustomerFrontend 7… |
CVE-2021-21435 | Medium | 5.7 | 2021-02-08 | Article Bcc fields and agent personal information are shown when customer prints the ticket (PDF) via external interface. This issue affects: OTRS AG OTRS 7.0… |
CVE-2021-21434 | Low | 3.5 | 2021-02-08 | Survey administrator can craft a survey in such way that malicious code can be executed in the agent interface (i.e. another agent who wants to make changes in… |
CVE-2020-1779 | Medium | 4.3 | 2021-02-08 | When dynamic templates are used (OTRSTicketForms), admin can use OTRS tags which are not masked properly and can reveal sensitive information. This issue affec… |
CVE-2020-1778 | Medium | 4.1 | 2020-11-23 | When OTRS uses multiple backends for user authentication (with LDAP), agents are able to login even if the account is set to invalid. This issue affects OTRS… |
CVE-2020-1777 | Medium | 4.3 | 2020-10-15 | Agent names that participates in a chat conversation are revealed in certain parts of the external interface as well as in chat transcriptions inside the ticke… |
CVE-2020-1776 | Low | 3.5 | 2020-07-20 | When an agent user is renamed or set to invalid the session belonging to the user is keept active. The session can not be used to access ticket data in the cas… |
CVE-2020-1775 | Low | 3.5 | 2020-06-08 | BCC recipients in mails sent from OTRS are visible in article detail on external interface. This issue affects OTRS: 8.0.3 and prior versions, 7.0.17 and prior… |
CVE-2020-1774 | Medium | 4.5 | 2020-04-28 | When user downloads PGP or S/MIME keys/certificates, exported file has same name for private and public keys. Therefore it's possible to mix them and to send p… |
CVE-2020-1773 | High | 7.3 | 2020-03-27 | An attacker with the ability to generate session IDs or password reset tokens, either by being able to authenticate or by exploiting OSA-2020-09, may be able t… |
CVE-2020-1772 | Medium | 6.5 | 2020-03-27 | It's possible to craft Lost Password requests with wildcards in the Token value, which allows attacker to retrieve valid Token(s), generated by users which alr… |
CVE-2020-1771 | Medium | 4.6 | 2020-03-27 | Attacker is able craft an article with a link to the customer address book with malicious content (JavaScript). When agent opens the link, JavaScript code is e… |
CVE-2020-1770 | Low | 2.4 | 2020-03-27 | Support bundle generated files could contain sensitive information that might be unwanted to be disclosed. This issue affects: ((OTRS)) Community Edition: 5.0… |
CVE-2020-1769 | Low | 3.5 | 2020-03-27 | In the login screens (in agent and customer interface), Username and Password fields use autocomplete, which might be considered as security issue. This issue… |
CVE-2019-16375 | Medium | 5.4 | 2020-03-19 | An issue was discovered in Open Ticket Request System (OTRS) 7.0.x through 7.0.11, and Community Edition 5.0.x through 5.0.37 and 6.0.x through 6.0.22. An atta… |
CVE-2019-13457 | Medium | 4.3 | 2020-03-10 | An issue was discovered in Open Ticket Request System (OTRS) 7.0.x through 7.0.8. A customer user can use the search results to disclose information from their… |
CVE-2019-10065 | Medium | 4.3 | 2020-03-10 | An issue was discovered in Open Ticket Request System (OTRS) 7.0 through 7.0.6. An attacker who is logged into OTRS as a customer user can use the search resul… |
CVE-2013-4088 | Medium | 6.5 | 2020-02-21 | Kernel/Modules/AgentTicketWatcher.pm in Open Ticket Request System (OTRS) 3.0.x before 3.0.21, 3.1.x before 3.1.17, and 3.2.x before 3.2.8 does not properly re… |
CVE-2013-3551 | Medium | 6.5 | 2020-02-21 | Kernel/Modules/AgentTicketPhone.pm in Open Ticket Request System (OTRS) 3.0.x before 3.0.20, 3.1.x before 3.1.16, and 3.2.x before 3.2.7, and OTRS ITSM 3.0.x b… |
CVE-2013-2637 | Medium | 6.1 | 2020-02-12 | A Cross-Site Scripting (XSS) Vulnerability exists in OTRS ITSM prior to 3.2.4, 3.1.8, and 3.0.7 and FAQ prior to 2.1.4 and 2.0.8 via changes, workorder items… |
CVE-2020-1768 | Medium | 5.4 | 2020-02-07 | The external frontend system uses numerous background calls to the backend. Each background request is treated as user activity so the SessionMaxIdleTime will… |
CVE-2020-1767 | Low | 3.5 | 2020-01-10 | Agent A is able to save a draft (i.e. for customer reply). Then Agent B can open the draft, change the text completely and send it in the name of Agent A. For… |
CVE-2020-1766 | Low | 2.0 | 2020-01-10 | Due to improper handling of uploaded images it is possible in very unlikely and rare conditions to force the agents browser to execute malicious javascript fro… |
CVE-2020-1765 | Low | 3.5 | 2020-01-10 | An improper control of parameters allows the spoofing of the from fields of the following screens: AgentTicketCompose, AgentTicketForward, AgentTicketBounce an… |
CVE-2019-18179 | Medium | 4.3 | 2020-01-06 | An issue was discovered in Open Ticket Request System (OTRS) 7.0.x through 7.0.12, and Community Edition 5.0.x through 5.0.38 and 6.0.x through 6.0.23. An atta… |
CVE-2019-18180 | Medium | 5.3 | 2019-12-05 | Improper Check for filenames with overly long extensions in PostMaster (sending in email) or uploading files (e.g. attaching files to mails) of ((OTRS)) Commun… |
CVE-2013-2625 | Medium | 6.5 | 2019-11-27 | An Access Bypass issue exists in OTRS Help Desk before 3.2.4, 3.1.14, and 3.0.19, OTRS ITSM before 3.2.3, 3.1.8, and 3.0.7, and FAQ before 2.2.3, 2.1.4, and 2… |
CVE-2019-13458 | Medium | 6.5 | 2019-08-21 | An issue was discovered in Open Ticket Request System (OTRS) 7.0.x through 7.0.8, and Community Edition 5.0.x through 5.0.36 and 6.0.x through 6.0.19. An attac… |
CVE-2019-12746 | Medium | 6.5 | 2019-08-21 | An issue was discovered in Open Ticket Request System (OTRS) Community Edition 5.0.x through 5.0.36 and 6.0.x through 6.0.19. A user logged into OTRS as an age… |
CVE-2018-11563 | Medium | 4.6 | 2019-07-08 | An issue was discovered in Open Ticket Request System (OTRS) 6.0.x through 6.0.7. A carefully constructed email could be used to inject and execute arbitrary s… |
CVE-2019-12248 | Medium | 4.3 | 2019-06-17 | An issue was discovered in Open Ticket Request System (OTRS) 7.0.x through 7.0.7, Community Edition 6.0.x through 6.0.19, and Community Edition 5.0.x through 5… |
CVE-2019-12497 | Medium | 5.3 | 2019-06-17 | An issue was discovered in Open Ticket Request System (OTRS) 7.0.x through 7.0.8, Community Edition 6.0.x through 6.0.19, and Community Edition 5.0.x through 5… |
CVE-2019-9753 | Low | 3.5 | 2019-06-03 | An issue was discovered in Open Ticket Request System (OTRS) 7.x before 7.0.5. An attacker who is logged into OTRS as an agent or a customer user can use the s… |
CVE-2019-9892 | Medium | 6.5 | 2019-05-22 | An issue was discovered in Open Ticket Request System (OTRS) 5.x through 5.0.34, 6.x through 6.0.17, and 7.x through 7.0.6. An attacker who is logged into OTRS… |
CVE-2019-10067 | Medium | 5.4 | 2019-05-22 | An issue was discovered in Open Ticket Request System (OTRS) 7.x through 7.0.6 and Community Edition 5.0.x through 5.0.35 and 6.0.x through 6.0.17. An attacker… |
CVE-2019-10066 | Medium | 5.4 | 2019-05-22 | An issue was discovered in Open Ticket Request System (OTRS) 7.x through 7.0.6, Community Edition 6.0.x through 6.0.17, and OTRSAppointmentCalendar 5.0.x throu… |
CVE-2019-9752 | Medium | 5.4 | 2019-03-13 | An issue was discovered in Open Ticket Request System (OTRS) 5.x before 5.0.34, 6.x before 6.0.16, and 7.x before 7.0.4. An attacker who is logged into OTRS as… |
CVE-2019-9751 | Medium | 4.8 | 2019-03-13 | An issue was discovered in Open Ticket Request System (OTRS) 6.x before 6.0.17 and 7.x before 7.0.5. An attacker who is logged into OTRS as an admin user may m… |
CVE-2018-20800 | Medium | 6.5 | 2019-03-13 | An issue was discovered in Open Ticket Request System (OTRS) 5.0.31 and 6.0.13. Users updating to 6.0.13 (also patchlevel updates) or 5.0.31 (only major update… |
CVE-2018-19143 | Medium | 6.5 | 2018-11-11 | Open Ticket Request System (OTRS) 4.0.x before 4.0.33, 5.0.x before 5.0.31, and 6.0.x before 6.0.13 allows an authenticated user to delete files via a modified… |
CVE-2018-19142 | Medium | 4.8 | 2018-11-11 | Open Ticket Request System (OTRS) 6.0.x before 6.0.13 allows an admin to conduct an XSS attack via a modified URL. |
CVE-2018-19141 | Medium | 4.8 | 2018-11-11 | Open Ticket Request System (OTRS) 4.0.x before 4.0.33 and 5.0.x before 5.0.31 allows an admin to conduct an XSS attack via a modified URL because user and cust… |
CVE-2018-16587 | Medium | 6.5 | 2018-09-28 | In Open Ticket Request System (OTRS) 4.0.x before 4.0.32, 5.0.x before 5.0.30, and 6.0.x before 6.0.11, an attacker could send a malicious email to an OTRS sys… |
CVE-2018-16586 | Medium | 4.3 | 2018-09-28 | In Open Ticket Request System (OTRS) 4.0.x before 4.0.32, 5.0.x before 5.0.30, and 6.0.x before 6.0.11, an attacker could send a malicious email to an OTRS sys… |