CVE-2024-23793CWE-22

Upload of files outside application directory

Medium · published June 6, 2024

CVSS v3.1
6.3
EPSS
1%
Percentile
55.5
In the wild
Unconfirmed
What it is

The file upload feature in OTRS and ((OTRS)) Community Edition has a path traversal vulnerability. This issue permits authenticated agents or customer users to upload potentially harmful files to directories accessible by the web server, potentially leading to the execution of local code like Perl scripts.

This issue affects OTRS: from 7.0.X through 7.0.49, 8.0.X, 2023.X, from 2024.X through 2024.3.2; ((OTRS)) Community Edition: from 6.0.1 through 6.0.34.

The record
Technical detail
CVSS v3.1
6.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:L
CVSS v4.0
Not supplied
EPSS
0.00783 · 55.5th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2024-06-06T18:06Z
EPSS history
Timeline
  • 06 JUN 18:06Z
    Upload of files outside application directory
    cvelistv5