CVE-2023-38060
Last modified
CVE-2023-38060 is a high-severity vulnerability rated 8.8/10 on the CVSS scale. Improper Input Validation vulnerability in the ContentType parameter for attachments on TicketCreate or TicketUpdate operations of the OTRS Generic Interface modules allows any authenticated attacker to to perform an host header injection for the ContentType header of the attachment. This issue affects OTRS: from 7.0.X before 7.0.45, from 8.0.X before 8.0.35; ((OTRS)) Community Edition: from 6.0.1 through 6.0.34.. EPSS estimates a 0.57% chance of exploitation in the next 30 days.
Description
Improper Input Validation vulnerability in the ContentType parameter for attachments on TicketCreate or TicketUpdate operations of the OTRS Generic Interface modules allows any authenticated attacker to to perform an host header injection for the ContentType header of the attachment. This issue affects OTRS: from 7.0.X before 7.0.45, from 8.0.X before 8.0.35; ((OTRS)) Community Edition: from 6.0.1 through 6.0.34.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Otrs | Otrs | >= 6.0.1, <= 6.0.34 |
| Otrs | Otrs | >= 7.0.0, < 7.0.45 |
| Otrs | Otrs | >= 8.0.0, < 8.0.35 |
References
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2023-38060?
How severe is CVE-2023-38060?
How do I fix CVE-2023-38060?
Are you affected by CVE-2023-38060?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST