CVE-2023-1250CWE-20

Code execution through ACL creation

High · published March 20, 2023

CVSS v3.1
7.4
EPSS
0%
Percentile
21.0
In the wild
Unconfirmed
What it is

Improper Input Validation vulnerability in OTRS AG OTRS (ACL modules), OTRS AG ((OTRS)) Community Edition (ACL modules) allows Local Execution of Code. When creating/importing an ACL it was possible to inject code that gets executed via manipulated comments and ACL-names

This issue affects OTRS: from 7.0.X before 7.0.42, from 8.0.X before 8.0.31; ((OTRS)) Community Edition: from 6.0.1 through 6.0.34.

The record
Technical detail
CVSS v3.1
7.4 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00295 · 21.0th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2023-03-20T08:20Z
EPSS history
Timeline
  • 20 MAR 08:20Z
    Code execution through ACL creation
    cvelistv5