CVE-2010-4766: Input Validation
The AgentTicketForward feature in Open Ticket Request System (OTRS) before 2.4.7 does not properly remove inline images from HTML e-mail messages, which allows remote attackers to obtain potentially sensitive image information in opportunistic circumstances by reading a forwarded message in a standard e-mail client.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2010-4766?
CVE-2010-4766 has a medium severity level due to its potential to expose sensitive information via improperly handled inline images in forwarded messages.
How do I fix CVE-2010-4766?
To fix CVE-2010-4766, update to a patched version of Open Ticket Request System (OTRS) 2.4.7 or later where the issue is resolved.
What kind of information can be exposed due to CVE-2010-4766?
CVE-2010-4766 can expose potentially sensitive image information contained in HTML e-mail messages.
Which versions of OTRS are affected by CVE-2010-4766?
CVE-2010-4766 affects OTRS versions before 2.4.7, including various beta and stable releases prior to that version.
Who might be affected by CVE-2010-4766?
Users who rely on OTRS versions prior to 2.4.7 could be affected, as attackers may exploit the vulnerability to access sensitive image data.