CVE-2025-24389CWE-532

SMTP Password will be shown in cleartext on some SMTP errors

Medium · published January 27, 2025

CVSS v3.1
6.3
EPSS
0%
Percentile
3.0
In the wild
Unconfirmed
What it is

Certain errors of the upstream libraries will insert sensitive information in the OTRS or ((OTRS)) Community Edition log mechanism and mails send to the system administrator.

This issue affects:

* OTRS 7.0.X

* OTRS 8.0.X

* OTRS 2023.X

* OTRS 2024.X

* ((OTRS)) Community Edition: 6.0.x

Products based on the ((OTRS)) Community Edition also very likely to be affected

The record
Technical detail
CVSS v3.1
6.3 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00140 · 3.0th percentile
Weakness
CWE-532 · Insertion of Sensitive Information into Log File
Published
2025-01-27T05:59Z
EPSS history
Timeline
  • 27 JAN 05:59Z
    SMTP Password will be shown in cleartext on some SMTP errors
    cvelistv5