CVE-2024-23790CWE-20

Missing file type check in avatar picture upload

Low · published January 29, 2024

CVSS v3.1
3.5
EPSS
0%
Percentile
15.9
In the wild
Unconfirmed
What it is

Improper Input Validation vulnerability in the upload functionality for user avatars allows functionality misuse due to missing check of filetypes.

This issue affects OTRS: from 7.0.X through 7.0.48, from 8.0.X through 8.0.37, from 2023 through 2023.1.1.

The record
Technical detail
CVSS v3.1
3.5 · LOW
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00253 · 15.9th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2024-01-29T09:21Z
EPSS history
Timeline
  • 29 JAN 09:21Z
    Missing file type check in avatar picture upload
    cvelistv5