CVE Vulnerabilities

CVE-2019-13458

Published: Aug 21, 2019 | Modified: Aug 31, 2023
CVSS 3.x
6.5
MEDIUM
Source:
NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS 2.x
4 MEDIUM
AV:N/AC:L/Au:S/C:P/I:N/A:N
RedHat/V2
RedHat/V3
Ubuntu
MEDIUM

An issue was discovered in Open Ticket Request System (OTRS) 7.0.x through 7.0.8, and Community Edition 5.0.x through 5.0.36 and 6.0.x through 6.0.19. An attacker who is logged into OTRS as an agent user with appropriate permissions can leverage OTRS notification tags in templates in order to disclose hashed user passwords.

Affected Software

Name Vendor Start Version End Version
Otrs Otrs 5.0.0 (including) 5.0.36 (including)
Otrs Otrs 6.0.0 (including) 6.0.19 (including)
Otrs Otrs 7.0.0 (including) 7.0.8 (including)
Otrs2 Ubuntu bionic *
Otrs2 Ubuntu cosmic *
Otrs2 Ubuntu disco *
Otrs2 Ubuntu eoan *
Otrs2 Ubuntu esm-apps/bionic *
Otrs2 Ubuntu esm-apps/focal *
Otrs2 Ubuntu esm-apps/jammy *
Otrs2 Ubuntu esm-apps/xenial *
Otrs2 Ubuntu focal *
Otrs2 Ubuntu groovy *
Otrs2 Ubuntu hirsute *
Otrs2 Ubuntu impish *
Otrs2 Ubuntu jammy *
Otrs2 Ubuntu trusty *
Otrs2 Ubuntu upstream *
Otrs2 Ubuntu xenial *

References