CVE-2022-0474: Disclosure of mail addresses
Full list of recipients from customer users in a contact field could be disclosed in notification emails event when the notification is set to be sent to each recipient individually. This issue affects: OTRS AG OTRSCustomContactFields 8.0.x version: 8.0.11 and prior versions.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2022-0474.
What is the title of this vulnerability?
The title of this vulnerability is 'Full list of recipients from customer users in a contact field could be disclosed in notification emails.'
What software is affected by this vulnerability?
The OTRS AG OTRSCustomContactFields 8.0.x version: 8.0.11 and prior versions are affected by this vulnerability.
What is the severity of CVE-2022-0474?
The severity of CVE-2022-0474 is classified as low, with a severity value of 3.5.
How can I fix the vulnerability CVE-2022-0474?
To fix the vulnerability CVE-2022-0474, it is recommended to update to version 8.0.12 or later of OTRS AG OTRSCustomContactFields.