CVE-2019-13458: Medium severity otrs vulnerability
An issue was discovered in Open Ticket Request System (OTRS) 7.0.x through 7.0.8, and Community Edition 5.0.x through 5.0.36 and 6.0.x through 6.0.19. An attacker who is logged into OTRS as an agent user with appropriate permissions can leverage OTRS notification tags in templates in order to disclose hashed user passwords.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2019-13458?
CVE-2019-13458 has been rated as a high severity vulnerability due to potential information disclosure risks.
How do I fix CVE-2019-13458?
To fix CVE-2019-13458, upgrade to OTRS versions 7.0.9 or later, or versions 6.0.20 or later.
Who is affected by CVE-2019-13458?
CVE-2019-13458 affects OTRS versions 7.0.x through 7.0.8, 6.0.x through 6.0.19, and 5.0.x through 5.0.36.
Can CVE-2019-13458 be exploited remotely?
CVE-2019-13458 requires an attacker to be logged into OTRS as an agent user, making it less likely to be exploited remotely.
What are the potential impacts of CVE-2019-13458?
The potential impacts of CVE-2019-13458 include unauthorized information disclosure due to improper handling of notification tags in templates.