CVE-2019-13458

An issue was discovered in Open Ticket Request System (OTRS) 7.0.x through 7.0.8, and Community Edition 5.0.x through 5.0.36 and 6.0.x through 6.0.19. An attacker who is logged into OTRS as an agent user with appropriate permissions can leverage OTRS notification tags in templates in order to disclose hashed user passwords.

• http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00038.htmlBroken Link
• http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00066.htmlBroken Link
• http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00077.htmlBroken Link
• https://community.otrs.com/security-advisory-2019-12-security-update-for-otrs-framework/Patch, Vendor Advisory
• https://lists.debian.org/debian-lts-announce/2019/08/msg00018.htmlMailing List, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2023/08/msg00040.html
• https://www.otrs.com/category/release-and-security-notes-en/Release Notes
• http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00038.htmlBroken Link
• http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00066.htmlBroken Link
• http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00077.htmlBroken Link
• https://community.otrs.com/security-advisory-2019-12-security-update-for-otrs-framework/Patch, Vendor Advisory
• https://lists.debian.org/debian-lts-announce/2019/08/msg00018.htmlMailing List, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2023/08/msg00040.html
• https://www.otrs.com/category/release-and-security-notes-en/Release Notes

Published

Aug 21, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-13452In Xymon through 4.3.28, a buffer overflow vulnerability exi…
• CVE-2019-13453Zipios before 0.1.7 does not properly handle certain malform…
• CVE-2019-13454ImageMagick 7.0.1-0 to 7.0.8-54 Q16 allows Division by Zero …6.5
• CVE-2019-13455In Xymon through 4.3.28, a stack-based buffer overflow vulne…
• CVE-2019-13456In FreeRADIUS 3.0 through 3.0.19, on average 1 in every 2048…6.5
• CVE-2019-13457An issue was discovered in Open Ticket Request System (OTRS)…4.3
• CVE-2019-1346A denial of service vulnerability exists when Windows improp…6.5
• CVE-2019-13461In PrestaShop before 1.7.6.0 RC2, the id_address_delivery an…
• CVE-2019-13462Lansweeper before 7.1.117.4 allows unauthenticated SQL injec…
• CVE-2019-13463An XSS vulnerability in qcopd-shortcode-generator.php in the…6.1
• CVE-2019-13464An issue was discovered in OWASP ModSecurity Core Rule Set (…
• CVE-2019-13465An issue was discovered in the ROS communications-related pa…8.6