CVE-2024-23792

Summary

When adding attachments to ticket comments, another user can add attachments as well impersonating the orginal user. The attack requires a logged-in other user to know the UUID. While the legitimate user completes the comment, the malicious user can add more files to the comment.

This issue affects OTRS: from 7.0.X through 7.0.48, from 8.0.X through 8.0.37, from 2023.X through 2023.1.1.

Affected Software

VendorProductVersion RangeStatus
OTRS AGOTRS7.0.x <= 7.0.48affected
OTRS AGOTRS8.0.x <= 8.0.37affected
OTRS AGOTRS2023.x <= 2023.1.1affected

Weaknesses

  • CWE-287: CWE-287 Improper Authentication

ADP Enrichment

CVE Program Container

Additional References

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

References