CVE-2024-23791: Unnecessary data is written to log if issues during indexing occurs
Insertion of debug information into log file during building the elastic search index allows reading of sensitive information from articles.This issue affects OTRS: from 7.0.X through 7.0.48, from 8.0.X through 8.0.37, from 2023.X through 2023.1.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OTRSto a version that resolves this vulnerability.Fixed in 7.0.49 - Upgrade
Upgrade
OTRSto a version that resolves this vulnerability.Patch OTRS Patch 2024.1.1
Event History
Frequently Asked Questions
What is the severity of CVE-2024-23791?
CVE-2024-23791 is considered a critical vulnerability due to the potential exposure of sensitive information.
How do I fix CVE-2024-23791?
To fix CVE-2024-23791, you should update OTRS to versions 7.0.49, 8.0.38, or 2023.1.2 or higher.
What versions are affected by CVE-2024-23791?
CVE-2024-23791 affects OTRS versions from 7.0.X up to 7.0.48, 8.0.X up to 8.0.37, and 2023.X up to 2023.1.1.
What type of information could be exposed due to CVE-2024-23791?
CVE-2024-23791 could expose sensitive information included in debug information within log files.
Who is impacted by CVE-2024-23791?
Users of OTRS versions 7.0.X, 8.0.X, and 2023.X are impacted by CVE-2024-23791.