CVE-2023-38056: Code execution via System Configuration
Improper Neutralization of commands allowed to be executed via OTRS System Configuration e.g. SchedulerCronTaskModule using UnitTests modules allows any authenticated attacker with admin privileges local execution of Code.This issue affects OTRS: from 7.0.X before 7.0.45, from 8.0.X before 8.0.35; ((OTRS)) Community Edition: from 6.0.1 through 6.0.34.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is CVE-2023-38056?
CVE-2023-38056 is a vulnerability that allows any authenticated attacker with admin privileges to locally execute code in the OTRS system.
What is the severity of CVE-2023-38056?
The severity of CVE-2023-38056 is high with a CVSS score of 7.2.
How does CVE-2023-38056 affect OTRS?
CVE-2023-38056 affects OTRS versions 6.0.1 to 6.0.34, 7.0.0 to 7.0.45, and 8.0.0 to 8.0.35.
How can an attacker exploit CVE-2023-38056?
An attacker with admin privileges can exploit CVE-2023-38056 by executing commands via the OTRS System Configuration, such as the SchedulerCronTaskModule using UnitTests modules.
How can I fix CVE-2023-38056?
To fix CVE-2023-38056, you should update OTRS to version 6.0.35, 7.0.46, or 8.0.36, as recommended by the vendor.