CVE-2024-6540: Information exlosure in external interface
Improper filtering of fields when using the export function in the ticket overview of the external interface in OTRS could allow an authorized user to download a list of tickets containing information about tickets of other customers. The problem only occurs if the TicketSearchLegacyEngine has been disabled by the administrator. This issue affects OTRS: 8.0.X, 2023.X, from 2024.X through 2024.4.x
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OTRSto a version that resolves this vulnerability.Fixed in 2024.5.2
Event History
Frequently Asked Questions
What is the severity of CVE-2024-6540?
CVE-2024-6540 has been assessed as potentially medium to high severity due to the risk of unauthorized data exposure.
How do I fix CVE-2024-6540?
To fix CVE-2024-6540, update your OTRS installation to a version above 2024.5.2 or apply any available patches from OTRS.
Who is affected by CVE-2024-6540?
Organizations using OTRS versions from 8.0.0 to 2024.5.2 are affected by CVE-2024-6540.
What type of vulnerability is CVE-2024-6540?
CVE-2024-6540 is classified as an improper access control vulnerability related to the export function in OTRS.
What are the potential consequences of CVE-2024-6540?
The potential consequences of CVE-2024-6540 include the unauthorized access to sensitive ticket information belonging to other customers.