CVE-2024-6540CWE-790

Information exlosure in external interface

Medium · published July 15, 2024

CVSS v3.1
5.7
EPSS
0%
Percentile
31.3
In the wild
Unconfirmed
What it is

Improper filtering of fields when using the export function in the ticket overview of the external interface in OTRS could allow an authorized user to download a list of tickets containing information about tickets of other customers. The problem only occurs if the TicketSearchLegacyEngine has been disabled by the administrator.

This issue affects OTRS: 8.0.X, 2023.X, from 2024.X through 2024.4.x

The record
Technical detail
CVSS v3.1
5.7 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00385 · 31.3th percentile
Weakness
CWE-790 · Improper Filtering of Special Elements
Published
2024-07-15T07:13Z
EPSS history
Timeline
  • 15 JUL 07:13Z
    Information exlosure in external interface
    cvelistv5