Otrs Ag
81 CVEs across 12 Otrs Ag products. Browse Otrs Ag vulnerabilities, severities, and proof-of-concept exploits.
Otrs Ag products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-48209 | High | 7.1 | 2026-06-01 | An improper neutralization of user-controllable input in OTRS or ((OTRS)) Community Edition ticket handling allows authenticated attackers to perform reflected… |
CVE-2026-48208 | Medium | 6.5 | 2026-06-01 | An improper neutralization of active SVG content in OTRS or ((OTRS)) Community Edition ticket article rendering allows attackers to inject specially crafted SV… |
CVE-2026-48191 | Low | 3.5 | 2026-06-01 | An incorrect handling of permissions in STORM powered by OTRS and in OTRS (2026.x and above) Document Search Article Meta Filters modules allows gaining knowle… |
CVE-2026-48190 | Low | 3.5 | 2026-06-01 | An incorrect handling of permissions in OTRS External Interface and the ConfigItem List module allows an authenticated customer to query the system for CI info… |
CVE-2026-48189 | Medium | 5.7 | 2026-06-01 | An improper Input Validation vulnerability in OTRS Customer Backend module allows to access customer information which are restricted to other groups. Please n… |
CVE-2026-48188 | Critical | 9.1 | 2026-06-01 | An improper Input Validation vulnerability in OTRS or ((OTRS)) Community Edition database layer module allows an unauthenticated SQL injection which can lead t… |
CVE-2026-48187 | Medium | 5.7 | 2026-06-01 | An uncontrolled allocation of resources without limits or throttling in the e-mail handling in OTRS allows excessive allocation which may lead to the abortion… |
CVE-2026-48210 | Medium | 5.7 | 2026-05-31 | An improper default configuration in OTRS 2026.3.1 causes ticket article forwarding actions to enforce the “Is visible for customer” flag by default and preven… |
CVE-2026-6060 | Medium | 4.5 | 2026-04-20 | A vulnerability in the SQL Box in the admin interface of OTRS leads to an uncontrolled resource consumption leading to a DoS against the webserver. will be kil… |
CVE-2025-24391 | Medium | 5.3 | 2025-07-14 | A vulnerability in the External Interface of OTRS allows conclusions to be drawn about the existence of user accounts through different HTTP response codes and… |
CVE-2025-24388 | Low | 3.8 | 2025-06-16 | A vulnerability in the OTRS Admin Interface and Agent Interface (versions before OTRS 8) allow parameter injection due to for an autheniticated agent or admin… |
CVE-2025-24387 | Medium | 4.8 | 2025-03-10 | A vulnerability in OTRS Application Server allows session hijacking due to missing attributes for sensitive cookie settings in HTTPS sessions. A request to an… |
CVE-2025-24390 | Medium | 6.8 | 2025-01-27 | A vulnerability in OTRS Application Server and reverse proxy settings allows session hijacking due to missing attributes for sensitive cookie settings in HTTPS… |
CVE-2025-24389 | Medium | 6.3 | 2025-01-27 | Certain errors of the upstream libraries will insert sensitive information in the OTRS or ((OTRS)) Community Edition log mechanism and mails send to the system… |
CVE-2024-43446 | Low | 3.5 | 2025-01-27 | An improper privilege management vulnerability in OTRS Generic Interface module allows change of the Ticket status even if the user only has ro permissions. … |
CVE-2024-43445 | Medium | 5.4 | 2025-01-27 | A vulnerability exists in OTRS and ((OTRS Community Edition)) that fail to set the HTTP response header X-Content-Type-Options to nosniff. An attacker could ex… |
CVE-2024-43444 | High | 8.2 | 2024-08-26 | Passwords of agents and customers are displayed in plain text in the OTRS admin log module if certain configurations regarding the authentication sources match… |
CVE-2024-43443 | Medium | 4.9 | 2024-08-26 | Improper Neutralization of Input done by an attacker with admin privileges ('Cross-site Scripting') in Process Management modules of OTRS and ((OTRS)) Communit… |
CVE-2024-43442 | Medium | 4.9 | 2024-08-26 | Improper Neutralization of Input done by an attacker with admin privileges ('Cross-site Scripting') in OTRS (System Configuration modules) and ((OTRS)) Commun… |
CVE-2024-6540 | Medium | 5.7 | 2024-07-15 | Improper filtering of fields when using the export function in the ticket overview of the external interface in OTRS could allow an authorized user to download… |
CVE-2024-23794 | Medium | 5.2 | 2024-07-15 | An incorrect privilege assignment vulnerability in the inline editing functionality of OTRS can lead to privilege escalation. This flaw allows an agent with re… |
CVE-2024-23793 | Medium | 6.3 | 2024-06-06 | The file upload feature in OTRS and ((OTRS)) Community Edition has a path traversal vulnerability. This issue permits authenticated agents or customer users to… |
CVE-2024-23792 | Medium | 5.3 | 2024-01-29 | When adding attachments to ticket comments, another user can add attachments as well impersonating the orginal user. The attack requires a logged-in other us… |
CVE-2024-23791 | Medium | 4.9 | 2024-01-29 | Insertion of debug information into log file during building the elastic search index allows reading of sensitive information from articles.This issue affects… |
CVE-2024-23790 | Low | 3.5 | 2024-01-29 | Improper Input Validation vulnerability in the upload functionality for user avatars allows functionality misuse due to missing check of filetypes. This issue… |
CVE-2023-6254 | High | 8.1 | 2023-11-27 | A Vulnerability in OTRS AgentInterface and ExternalInterface allows the reading of plain text passwords which are send back to the client in the server respons… |
CVE-2023-5422 | High | 8.7 | 2023-10-16 | The functions to fetch e-mail via POP3 or IMAP as well as sending e-mail via SMTP use OpenSSL for static SSL or TLS based communication. As the SSL_get_verify… |
CVE-2023-5421 | Low | 3.5 | 2023-10-16 | An attacker who is logged into OTRS as an user with privileges to create and change customer user data may manipulate the CustomerID field to execute JavaScrip… |
CVE-2023-38059 | Medium | 5.3 | 2023-10-16 | The loading of external images is not blocked, even if configured, if the attacker uses protocol-relative URL in the payload. This can be used to retreive the… |
CVE-2023-38060 | Medium | 6.3 | 2023-07-24 | Improper Input Validation vulnerability in the ContentType parameter for attachments on TicketCreate or TicketUpdate operations of the OTRS Generic Interface m… |
CVE-2023-38058 | Medium | 4.1 | 2023-07-24 | An improper privilege check in the OTRS ticket move action in the agent interface allows any as agent authenticated attacker to to perform a move of an tick… |
CVE-2023-38057 | Medium | 4.1 | 2023-07-24 | An improper input validation vulnerability in OTRS Survey modules allows any attacker with a link to a valid and unanswered survey request to inject javascript… |
CVE-2023-38056 | High | 7.2 | 2023-07-24 | Improper Neutralization of commands allowed to be executed via OTRS System Configuration e.g. SchedulerCronTaskModule using UnitTests modules allows any authen… |
CVE-2023-2534 | High | 7.6 | 2023-05-08 | Improper Authorization vulnerability in OTRS AG OTRS 8 (Websocket API backend) allows any as Agent authenticated attacker to track user behaviour and to gain l… |
CVE-2023-1250 | High | 7.4 | 2023-03-20 | Improper Input Validation vulnerability in OTRS AG OTRS (ACL modules), OTRS AG ((OTRS)) Community Edition (ACL modules) allows Local Execution of Code. When cr… |
CVE-2023-1248 | Medium | 6.1 | 2023-03-20 | Improper Input Validation vulnerability in OTRS AG OTRS (Ticket Actions modules), OTRS AG ((OTRS)) Community Edition (Ticket Actions modules) allows Cross-Site… |
CVE-2022-4427 | Medium | 6.5 | 2022-12-19 | Improper Input Validation vulnerability in OTRS AG OTRS, OTRS AG ((OTRS)) Community Edition allows SQL Injection via TicketSearch Webservice This issue affects… |
CVE-2022-39052 | High | 7.5 | 2022-10-17 | An external attacker is able to send a specially crafted email (with many recipients) and trigger a potential DoS of the system |
CVE-2022-39051 | Medium | 6.8 | 2022-09-05 | Attacker might be able to execute malicious Perl code in the Template toolkit, by having the admin installing an unverified 3th party package |
CVE-2022-39050 | Medium | 4.6 | 2022-09-05 | An attacker who is logged into OTRS as an admin user may manipulate customer URL field to store JavaScript code to be run later by any other agent when clickin… |
CVE-2022-39049 | Low | 3.5 | 2022-09-05 | An attacker who is logged into OTRS as an admin user may manipulate the URL to cause execution of JavaScript in the context of OTRS. |
CVE-2022-32741 | Medium | 5.3 | 2022-06-13 | Attacker is able to determine if the provided username exists (and it's valid) using Request New Password feature, based on the response time. |
CVE-2022-32740 | Low | 3.5 | 2022-06-13 | A reply to a forwarded email article by a 3rd party could unintensionally expose the email content to the ticket customer under certain circumstances. |
CVE-2022-32739 | Low | 3.5 | 2022-06-13 | When Secure::DisableBanner system configuration has been disabled and agent shares his calendar via public URL, received ICS file contains OTRS release number. |
CVE-2022-1004 | Medium | 4.3 | 2022-03-21 | Accounted time is shown in the Ticket Detail View (External Interface), even if ExternalFrontend::TicketDetailView###AccountedTimeDisplay is disabled. |
CVE-2022-0475 | Low | 3.5 | 2022-03-21 | Malicious translator is able to inject JavaScript code in few translatable strings (where HTML is allowed). The code could be executed in the Package manager… |
CVE-2021-36100 | Medium | 6.4 | 2022-03-21 | Specially crafted string in OTRS system configuration can allow the execution of any system command. |
CVE-2022-0474 | Low | 2.4 | 2022-02-07 | Full list of recipients from customer users in a contact field could be disclosed in notification emails event when the notification is set to be sent to each… |
CVE-2022-0473 | Low | 3.8 | 2022-02-07 | OTRS administrators can configure dynamic field and inject malicious JavaScript code in the error message of the regular expression check. When used in the age… |
CVE-2021-36097 | Low | 3.5 | 2021-10-18 | Agents are able to lock the ticket without the "Owner" permission. Once the ticket is locked, it could be moved to the queue where the agent has "rw" permissio… |
CVE-2021-36096 | Medium | 5.2 | 2021-09-06 | Generated Support Bundles contains private S/MIME and PGP keys if containing folder is not hidden. This issue affects: OTRS AG ((OTRS)) Community Edition 6.0.x… |
CVE-2021-36095 | Medium | 5.3 | 2021-09-06 | Malicious attacker is able to find out valid user logins by using the "lost password" feature. This issue affects: OTRS AG ((OTRS)) Community Edition version 6… |
CVE-2021-36094 | Medium | 5.7 | 2021-09-06 | It's possible to craft a request for appointment edit screen, which could lead to the XSS attack. This issue affects: OTRS AG ((OTRS)) Community Edition 6.0.x… |
CVE-2021-36093 | Medium | 5.3 | 2021-09-06 | It's possible to create an email which can be stuck while being processed by PostMaster filters, causing DoS. This issue affects: OTRS AG ((OTRS)) Community Ed… |
CVE-2021-36092 | Medium | 6.5 | 2021-07-26 | It's possible to create an email which contains specially crafted link and it can be used to perform XSS attack. This issue affects: OTRS AG ((OTRS)) Community… |
CVE-2021-36091 | Low | 3.5 | 2021-07-26 | Agents are able to list appointments in the calendars without required permissions. This issue affects: OTRS AG ((OTRS)) Community Edition: 6.0.x version 6.0.1… |
CVE-2021-21443 | Low | 3.5 | 2021-07-26 | Agents are able to list customer user emails without required permissions in the bulk action screen. This issue affects: OTRS AG ((OTRS)) Community Edition: 6… |
CVE-2021-21442 | Medium | 4.5 | 2021-07-26 | In the project create screen it's possible to inject malicious JS code to the certain fields. The code might be executed in the Reporting screen. This issue af… |
CVE-2021-21440 | Medium | 5.2 | 2021-07-26 | Generated Support Bundles contains private S/MIME and PGP keys if containing folder is not hidden. This issue affects: OTRS AG ((OTRS)) Community Edition 6.0.x… |
CVE-2021-21441 | High | 7.5 | 2021-06-16 | There is a XSS vulnerability in the ticket overview screens. It's possible to collect various information by having an e-mail shown in the overview screen. Att… |
CVE-2021-21439 | Medium | 6.5 | 2021-06-14 | DoS attack can be performed when an email contains specially designed URL in the body. It can lead to the high CPU usage and cause low quality of service, or i… |
CVE-2021-21438 | Low | 3.5 | 2021-03-22 | Agents are able to see linked FAQ articles without permissions (defined in FAQ Category). This issue affects: FAQ version 6.0.29 and prior versions, OTRS versi… |
CVE-2021-21437 | Low | 3.5 | 2021-03-22 | Agents are able to see linked Config Items without permissions, which are defined in General Catalog. This issue affects: OTRSCIsInCustomerFrontend 7.0.15 and… |
CVE-2021-21436 | Low | 3.5 | 2021-02-08 | Agents are able to see and link Config Items without permissions, which are defined in General Catalog. This issue affects: OTRS AG OTRSCIsInCustomerFrontend 7… |
CVE-2021-21435 | Medium | 5.7 | 2021-02-08 | Article Bcc fields and agent personal information are shown when customer prints the ticket (PDF) via external interface. This issue affects: OTRS AG OTRS 7.0… |
CVE-2021-21434 | Low | 3.5 | 2021-02-08 | Survey administrator can craft a survey in such way that malicious code can be executed in the agent interface (i.e. another agent who wants to make changes in… |
CVE-2020-1779 | Medium | 4.3 | 2021-02-08 | When dynamic templates are used (OTRSTicketForms), admin can use OTRS tags which are not masked properly and can reveal sensitive information. This issue affec… |
CVE-2020-1778 | Medium | 4.1 | 2020-11-23 | When OTRS uses multiple backends for user authentication (with LDAP), agents are able to login even if the account is set to invalid. This issue affects OTRS… |
CVE-2020-1777 | Medium | 4.3 | 2020-10-15 | Agent names that participates in a chat conversation are revealed in certain parts of the external interface as well as in chat transcriptions inside the ticke… |
CVE-2020-1776 | Low | 3.5 | 2020-07-20 | When an agent user is renamed or set to invalid the session belonging to the user is keept active. The session can not be used to access ticket data in the cas… |
CVE-2020-1775 | Low | 3.5 | 2020-06-08 | BCC recipients in mails sent from OTRS are visible in article detail on external interface. This issue affects OTRS: 8.0.3 and prior versions, 7.0.17 and prior… |
CVE-2020-1774 | Medium | 4.5 | 2020-04-28 | When user downloads PGP or S/MIME keys/certificates, exported file has same name for private and public keys. Therefore it's possible to mix them and to send p… |
CVE-2020-1773 | High | 7.3 | 2020-03-27 | An attacker with the ability to generate session IDs or password reset tokens, either by being able to authenticate or by exploiting OSA-2020-09, may be able t… |
CVE-2020-1772 | Medium | 6.5 | 2020-03-27 | It's possible to craft Lost Password requests with wildcards in the Token value, which allows attacker to retrieve valid Token(s), generated by users which alr… |
CVE-2020-1771 | Medium | 4.6 | 2020-03-27 | Attacker is able craft an article with a link to the customer address book with malicious content (JavaScript). When agent opens the link, JavaScript code is e… |
CVE-2020-1770 | Low | 2.4 | 2020-03-27 | Support bundle generated files could contain sensitive information that might be unwanted to be disclosed. This issue affects: ((OTRS)) Community Edition: 5.0… |
CVE-2020-1769 | Low | 3.5 | 2020-03-27 | In the login screens (in agent and customer interface), Username and Password fields use autocomplete, which might be considered as security issue. This issue… |
CVE-2020-1768 | Medium | 5.4 | 2020-02-07 | The external frontend system uses numerous background calls to the backend. Each background request is treated as user activity so the SessionMaxIdleTime will… |
CVE-2020-1767 | Low | 3.5 | 2020-01-10 | Agent A is able to save a draft (i.e. for customer reply). Then Agent B can open the draft, change the text completely and send it in the name of Agent A. For… |
CVE-2020-1766 | Low | 2.0 | 2020-01-10 | Due to improper handling of uploaded images it is possible in very unlikely and rare conditions to force the agents browser to execute malicious javascript fro… |
CVE-2020-1765 | Low | 3.5 | 2020-01-10 | An improper control of parameters allows the spoofing of the from fields of the following screens: AgentTicketCompose, AgentTicketForward, AgentTicketBounce an… |