CVE-2024-23793: Upload of files outside application directory
The file upload feature in OTRS and ((OTRS)) Community Edition has a path traversal vulnerability. This issue permits authenticated agents or customer users to upload potentially harmful files to directories accessible by the web server, potentially leading to the execution of local code like Perl scripts. This issue affects OTRS: from 7.0.X through 7.0.49, 8.0.X, 2023.X, from 2024.X through 2024.3.2; ((OTRS)) Community Edition: from 6.0.1 through 6.0.34.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2024-23793?
CVE-2024-23793 is considered a high-severity vulnerability due to its potential to allow the execution of malicious files on the server.
How do I fix CVE-2024-23793?
To fix CVE-2024-23793, patch your OTRS or ((OTRS)) Community Edition to the latest version that addresses this vulnerability.
Who is affected by CVE-2024-23793?
CVE-2024-23793 affects authenticated agents and customer users of OTRS and ((OTRS)) Community Edition versions listed in the affected software section.
What is the nature of the vulnerability in CVE-2024-23793?
CVE-2024-23793 is a path traversal vulnerability that allows unauthorized file uploads to directories accessible by the web server.
Can CVE-2024-23793 lead to remote code execution?
Yes, if exploited, CVE-2024-23793 can potentially lead to remote code execution on the affected server.