CVE-2024-43445CWE-20

Missing X-Content-Type-Options: nosniff Header Allows MIME Type Sniffing

Medium · published January 27, 2025

CVSS v3.1
5.4
EPSS
0%
Percentile
13.4
In the wild
Unconfirmed
What it is

A vulnerability exists in OTRS and ((OTRS Community Edition)) that fail to set the HTTP response header X-Content-Type-Options to nosniff. An attacker could exploit this vulnerability by uploading or inserting content that would be treated as a different MIME type than intended.

This issue affects:

* OTRS 7.0.X

* OTRS 8.0.X

* OTRS 2023.X

* OTRS 2024.X

* ((OTRS)) Community Edition: 6.0.x

Products based on the ((OTRS)) Community Edition also very likely to be affected

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00233 · 13.4th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2025-01-27T05:58Z
EPSS history
Timeline
  • 27 JAN 05:58Z
    Missing X-Content-Type-Options: nosniff Header Allows MIME Type Sniffing
    cvelistv5