CVE-2019-13458
First published: Wed Aug 21 2019(Updated: )
An issue was discovered in Open Ticket Request System (OTRS) 7.0.x through 7.0.8, and Community Edition 5.0.x through 5.0.36 and 6.0.x through 6.0.19. An attacker who is logged into OTRS as an agent user with appropriate permissions can leverage OTRS notification tags in templates in order to disclose hashed user passwords.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| OTRS | >=5.0.0<=5.0.36 | |
| OTRS | >=6.0.0<=6.0.19 | |
| OTRS | >=7.0.0<=7.0.8 | |
| Debian GNU/Linux | =8.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00038.html
- http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00066.html
- http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00077.html
- https://community.otrs.com/security-advisory-2019-12-security-update-for-otrs-framework/
- https://lists.debian.org/debian-lts-announce/2019/08/msg00018.html
- https://lists.debian.org/debian-lts-announce/2023/08/msg00040.html
- https://www.otrs.com/category/release-and-security-notes-en/
Frequently Asked Questions
What is the severity of CVE-2019-13458?
CVE-2019-13458 has been rated as a high severity vulnerability due to potential information disclosure risks.
How do I fix CVE-2019-13458?
To fix CVE-2019-13458, upgrade to OTRS versions 7.0.9 or later, or versions 6.0.20 or later.
Who is affected by CVE-2019-13458?
CVE-2019-13458 affects OTRS versions 7.0.x through 7.0.8, 6.0.x through 6.0.19, and 5.0.x through 5.0.36.
Can CVE-2019-13458 be exploited remotely?
CVE-2019-13458 requires an attacker to be logged into OTRS as an agent user, making it less likely to be exploited remotely.
What are the potential impacts of CVE-2019-13458?
The potential impacts of CVE-2019-13458 include unauthorized information disclosure due to improper handling of notification tags in templates.
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/last-modified-date
- agent/remedy
- agent/references
- agent/first-publish-date
- agent/description
- agent/event
- agent/source
- agent/author
- collector/nvd-api
- agent/software-canonical-lookup-request
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- vendor/otrs
- canonical/otrs
- version/otrs/5.0.0
- version/otrs/5.0.36
- version/otrs/6.0.0
- version/otrs/6.0.19
- version/otrs/7.0.0
- version/otrs/7.0.8
- vendor/debian
- canonical/debian gnu/linux
- version/debian gnu/linux/8.0