CVE-2010-3476
Open Ticket Request System (OTRS) 2.3.x before 2.3.6 and 2.4.x before 2.4.8 does not properly...
CVE-2010-3476 is a medium vulnerability (CVSS 5.0) in Otrs, published September 20, 2010. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.52%, the 85th percentile. Fixed in otrs2 2.4.8+dfsg1-1.
- Severity
- 5.0 MediumCVSS 2.0, NVD
- Exploit chance
- 2.52%EPSS, 85th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
2.4.8+dfsg1-1otrs2
Description
Open Ticket Request System (OTRS) 2.3.x before 2.3.6 and 2.4.x before 2.4.8 does not properly handle the matching of Perl regular expressions against HTML e-mail messages, which allows remote attackers to cause a denial of service (CPU consumption) via a large message, a different vulnerability than CVE-2010-2080.
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
otrs2Debian:11 | before 2.4.8+dfsg1-1, plus listed versions 2.0.4p01-102.0.4p01-112.0.4p01-122.0.4p01-132.0.4p01-14 Show 45 moreShow less2.0.4p01-14.12.0.4p01-152.0.4p01-162.0.4p01-172.0.4p01-182.0.4p01-62.0.4p01-72.0.4p01-82.0.4p01-92.0.99beta1-12.0.99beta1-22.1.1-12.1.3-12.1.4-12.1.4-22.1.5-12.1.5-22.1.5-32.1.6-12.1.7-12.1.7-22.2.0~beta2-12.2.0~beta3-12.2.1-12.2.2-12.2.3-12.2.4-12.2.5-12.2.5-22.2.6-12.2.7-12.2.7-22.2.7-2lenny12.2.7-2lenny22.2.7-2lenny32.2.7-32.3.2-12.3.2-22.3.3-12.3.4-12.3.4-22.3.4-32.3.4-42.3.4-52.3.4-6 | 2.4.8+dfsg1-1 |
What each source reports
NVD Score used
Open Ticket Request System (OTRS) 2.3.x before 2.3.6 and 2.4.x before 2.4.8 does not properly handle the matching of Perl regular expressions against HTML e-mail messages, which allows remote attackers to cause a denial of service (CPU consumption) via a large message, a different vulnerability than CVE-2010-2080.
- Record
CVE-2010-3476- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE ListNo score
Open Ticket Request System (OTRS) 2.3.x before 2.3.6 and 2.4.x before 2.4.8 does not properly handle the matching of Perl regular expressions against HTML e-mail messages, which allows remote attackers to cause a denial of service (CPU consumption) via a large message, a different vulnerability than CVE-2010-2080.
- Record
CVE-2010-3476- Updated
- 2026-11-02
EUVDEUVD-2010-3474No score
Open Ticket Request System (OTRS) 2.3.x before 2.3.6 and 2.4.x before 2.4.8 does not properly handle the matching of Perl regular expressions against HTML e-mail messages, which allows remote attackers to cause a denial of service (CPU consumption) via a large message, a different vulnerability than CVE-2010-2080.
- Record
EUVD-2010-3474- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-99jw-r98g-wv3rNo score
Open Ticket Request System (OTRS) 2.3.x before 2.3.6 and 2.4.x before 2.4.8 does not properly...
Open Ticket Request System (OTRS) 2.3.x before 2.3.6 and 2.4.x before 2.4.8 does not properly handle the matching of Perl regular expressions against HTML e-mail messages, which allows remote attackers to cause a denial of service (CPU consumption) via a large message, a different vulnerability than CVE-2010-2080.
- Record
GHSA-99jw-r98g-wv3r- Weakness
- CWE-20
- Updated
- 2026-11-02
OSVNo score
Open Ticket Request System (OTRS) 2.3.x before 2.3.6 and 2.4.x before 2.4.8 does not properly handle the matching of Perl regular expressions against HTML e-mail messages, which allows remote attackers to cause a denial of service (CPU consumption) via a large message, a different vulnerability than CVE-2010-2080.
- Record
CVE-2010-3476- Updated
- 2026-11-02
OSVDEBIAN-CVE-2010-3476No score
Open Ticket Request System (OTRS) 2.3.x before 2.3.6 and 2.4.x before 2.4.8 does not properly handle the matching of Perl regular expressions against HTML e-mail messages, which allows remote attackers to cause a denial of service (CPU consumption) via a large message, a different vulnerability than CVE-2010-2080.
- Record
DEBIAN-CVE-2010-3476- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
security-tracker.debian.org/tracker/CVE-2010-2080
secunia.com/advisories/41381
otrs.org/advisory/OSA-2010-02-en
exchange.xforce.ibmcloud.com/vulnerabilities/61869
lists.opensuse.org/opensuse-security-announce/2010-12/msg00006.html
securityfocus.com/bid/43264
nvd.nist.gov/vuln/detail/CVE-2010-3476
github.com/advisories/GHSA-99jw-r98g-wv3r
Left out here: 15 versions. The JSON record has them.