CVE-2023-38056CWE-78

Code execution via System Configuration

High · published July 24, 2023

CVSS v3.1
7.2
EPSS
1%
Percentile
58.5
In the wild
Unconfirmed
What it is

Improper Neutralization of commands allowed to be executed via OTRS System Configuration e.g. SchedulerCronTaskModule using UnitTests modules allows any authenticated attacker with admin privileges local execution of Code.This issue affects OTRS: from 7.0.X before 7.0.45, from 8.0.X before 8.0.35; ((OTRS)) Community Edition: from 6.0.1 through 6.0.34.

The record
Technical detail
CVSS v3.1
7.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00872 · 58.5th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2023-07-24T08:27Z
EPSS history
Timeline
  • 24 JUL 08:27Z
    Code execution via System Configuration
    cvelistv5