CVE-2019-12248: Medium severity otrs vulnerability
An issue was discovered in Open Ticket Request System (OTRS) 7.0.x through 7.0.7, Community Edition 6.0.x through 6.0.19, and Community Edition 5.0.x through 5.0.36. An attacker could send a malicious email to an OTRS system. If a logged-in agent user quotes it, the email could cause the browser to load external image resources.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2019-12248?
CVE-2019-12248 is considered a medium severity vulnerability that could allow an attacker to exploit the system through malicious email.
How do I fix CVE-2019-12248?
To fix CVE-2019-12248, it is recommended to update OTRS to version 7.0.8, 6.0.20, or 5.0.37 or apply the relevant patches provided by OTRS.
What versions are affected by CVE-2019-12248?
CVE-2019-12248 affects OTRS versions 5.0.0 through 5.0.36, 6.0.0 through 6.0.19, and 7.0.0 through 7.0.7.
What type of attack is described in CVE-2019-12248?
CVE-2019-12248 describes an attack where a malicious email could cause issues when quoted by a logged-in agent user in OTRS.
Is there any workaround for CVE-2019-12248?
A potential workaround for CVE-2019-12248 is to restrict email quoting functionality or limit the exposure of OTRS to untrusted email sources until a patch is applied.