CVE-2024-43445

A vulnerability exists in OTRS and ((OTRS Community Edition)) that fail to set the HTTP response header X-Content-Type-Options to nosniff. An attacker could exploit this vulnerability by uploading or inserting content that would be treated as a different MIME type than intended. This issue affects: * OTRS 7.0.X * OTRS 8.0.X * OTRS 2023.X * OTRS 2024.X * ((OTRS)) Community Edition: 6.0.x Products based on the ((OTRS)) Community Edition also very likely to be affected

• CWE-20

• https://otrs.com/release-notes/otrs-security-advisory-2025-01/

Published

Jan 27, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-4344The Shield Security – Smart Bot Blocking & Intrusion Prevent…4.3
• CVE-2024-43440A flaw was found in moodle. A local file may include risks w…7.5
• CVE-2024-43441Authentication Bypass by Assumed-Immutable Data vulnerabilit…9.8
• CVE-2024-43442Improper Neutralization of Input done by an attacker with ad…4.9
• CVE-2024-43443Improper Neutralization of Input done by an attacker with ad…4.9
• CVE-2024-43444Passwords of agents and customers are displayed in plain tex…8.2
• CVE-2024-43446An improper privilege management vulnerability in OTRS Gener…3.5
• CVE-2024-43447Windows SMBv3 Server Remote Code Execution Vulnerability8.1
• CVE-2024-43449Windows USB Video Class System Driver Elevation of Privilege…6.8
• CVE-2024-4345The Startklar Elementor Addons plugin for WordPress is vulne…9.8
• CVE-2024-43450Windows DNS Spoofing Vulnerability7.5
• CVE-2024-43451NTLM Hash Disclosure Spoofing Vulnerability6.5