CVE-2024-23793: Upload of files outside application directory
First published: Thu Jun 06 2024(Updated: )
The file upload feature in OTRS and ((OTRS)) Community Edition has a path traversal vulnerability. This issue permits authenticated agents or customer users to upload potentially harmful files to directories accessible by the web server, potentially leading to the execution of local code like Perl scripts. This issue affects OTRS: from 7.0.X through 7.0.49, 8.0.X, 2023.X, from 2024.X through 2024.3.2; ((OTRS)) Community Edition: from 6.0.1 through 6.0.34.
Credit: security@otrs.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| OTRS | >=7.0.0<7.0.49>=8.0.X>=2023.X>=2024.0<2024.3.2 | |
| >=6.0.1<6.0.34 |
Remedy
Update to OTRS 2024.4.3 or OTRS 7.0.50 (extended support only)
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
- agent/title
- agent/weakness
- agent/remedy
- agent/references
- agent/first-publish-date
- agent/type
- agent/description
- agent/severity
- agent/author
- agent/event
- collector/nvd-api
- source/NVD
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/source
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/softwarecombine
- vendor/otrs
- canonical/otrs