CVE-2024-43444: Passwords are written to Admin Log Module
Passwords of agents and customers are displayed in plain text in the OTRS admin log module if certain configurations regarding the authentication sources match and debugging for the authentication backend has been enabled.
This issue affects:
OTRS from 7.0.X through 7.0.50 OTRS 8.0.X OTRS 2023.X OTRS from 2024.X through 2024.5.X ((OTRS)) Community Edition: 6.0.x
Products based on the ((OTRS)) Community Edition also very likely to be affected
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2024-43444?
CVE-2024-43444 is considered a high severity vulnerability due to the exposure of sensitive credentials in plain text.
How do I fix CVE-2024-43444?
To mitigate CVE-2024-43444, users should disable debugging for the authentication backend and ensure that logs do not contain sensitive information.
Which versions of OTRS are affected by CVE-2024-43444?
CVE-2024-43444 affects OTRS versions from 7.0.0 to 7.0.50, as well as specific configurations in versions 8.0.X and 2023.X.
Does CVE-2024-43444 impact OTRS Community Edition?
Yes, CVE-2024-43444 also affects the OTRS Community Edition up to version 6.0.X.
What information is exposed in CVE-2024-43444?
CVE-2024-43444 exposes passwords of agents and customers in plain text in the OTRS admin log module.