Skip to contentOtrs Ag Otrs vulnerabilities
- otrs, otrs ag ((otrs)) community edition +1 morePossible XSS in Admin InterfaceCVE-2022-390493.5 Low
- otrsInformation disclosure in Request New Password featureCVE-2022-327415.3 Medium
- otrsInformation disclosure in the External InterfaceCVE-2022-327403.5 Low
- otrs, otrs calendar resource planning, otrs ag otrscalendarresourceplanning +2 moreOTRS version number is always in the exported ICS filesCVE-2022-327393.5 Low
- otrsInformation disclosure in the External InterfaceCVE-2022-10044.3 Medium
- otrsPossible XSS attack via translationCVE-2022-04753.5 Low
- otrs, otrs itsm, storm +3 more +5 moreAuthenticated remote code executionCVE-2021-361006.4 Medium
- otrs ag otrscustomcontactfields, otrs custom contact fields +1 moreDisclosure of mail addressesCVE-2022-04742.4 Low
- otrsDynamic field error message is vulnerable to XSSCVE-2022-04733.8 Low
- otrsAgents are able to lock the ticket without the "Owner" permissionCVE-2021-360973.5 Low
- otrs, otrs ag ((otrs)) community edition +1 moreSupport Bundle includes S/Mime and PGP secret or PINCVE-2021-360965.2 Medium
- otrs, otrs ag ((otrs)) community edition +1 moreUser enumeration issue using "lost password" featureCVE-2021-360955.3 Medium
- otrs, otrs ag ((otrs)) community edition +1 moreXSS attack in appointment edit popup screenCVE-2021-360945.7 Medium
- otrs, otrs ag ((otrs)) community edition +1 moreDoS attack using PostMaster filtersCVE-2021-360935.3 Medium
- otrs, otrs ag ((otrs)) community edition +1 moreXSS attack using special link in emailCVE-2021-360926.5 Medium
- otrs, otrs ag ((otrs)) community edition +1 moreUnautorized access to the calendar appointmentsCVE-2021-36091Fix available3.5 Low
- otrs, otrs ag ((otrs)) community edition +1 moreUnautorized listing of the customer user emailsCVE-2021-21443Fix available3.5 Low
- otrs, otrs ag ((otrs)) community edition +1 moreSupport Bundle includes S/Mime and PGP keysCVE-2021-21440Fix available5.2 Medium
- otrs, otrs ag ((otrs)) community edition +1 moreXSS in the ticket overview screensCVE-2021-21441Fix available7.5 High
- otrs, otrs ag ((otrs)) community edition +1 morePossible DoS attack using a special crafted URL in email bodyCVE-2021-21439Fix available6.5 Medium
- otrs faq, otrs +1 moreFAQ articles are shown to users without permissionCVE-2021-214383.5 Low
- otrs itsmconfigurationmanagement, otrscisincustomerfrontend +1 moreConfig Items are shown to users without permissionCVE-2021-214373.5 Low
- otrs ag otrscisincustomerfrontend, otrs cis in customer frontend +1 moreAgent is able to link customer's Config Items without permissionCVE-2021-214363.5 Low
- otrsInformation exposure in PDF exportCVE-2021-214355.7 Medium
- otrs ag otrsticketforms, otrs ticket forms +1 moreDynamic templates reveal sensitive data when OTRS tags are usedCVE-2020-17794.3 Medium
- otrsBypassing user account validationCVE-2020-17784.1 Medium
- otrsAgent names disclosed in chat featureCVE-2020-17774.3 Medium
- otrs, otrs ag ((otrs)) community edition +1 moreInvalidating or changing user does not invalidate sessionCVE-2020-1776Fix available3.5 Low
- otrsInformation disclosure in external interfaceCVE-2020-17753.5 Low
- otrs, otrs ag ((otrs)) community edition, debian linux +2 moreInformation disclosureCVE-2020-1774Fix available4.5 Medium
- otrs, otrs ag ((otrs)) community edition +1 moreSession / Password / Password token leakCVE-2020-1773Fix available7.3 High
- otrs, otrs ag ((otrs)) community edition, debian linux +2 more +4 moreInformation DisclosureCVE-2020-1772Fix available6.5 Medium
- otrs, otrs ag ((otrs)) community edition +1 morePossible XSS in Customer user address bookCVE-2020-1771Fix available4.6 Medium
- otrs, otrs ag ((otrs)) community edition, debian linux +2 more +4 moreInformation disclosure in support bundle filesCVE-2020-1770Fix available2.4 Low
- otrs, otrs ag ((otrs)) community edition, opensuse backports sle +1 more +3 moreAutocomplete in the form login screensCVE-2020-1769Fix available3.5 Low
- otrsExternal Interface does not invalidate sessionCVE-2020-17685.4 Medium
- otrs, otrs ag ((otrs)) community edition, debian linux +2 morePossible to send drafted messages as wrong agentCVE-2020-1767Fix available3.5 Low
- otrs, otrs ag ((otrs)) community edition, debian linux +2 moreImproper handling of uploaded inline imagesCVE-2020-1766Fix available2.0 Low
- otrs, otrs ag ((otrs)) community edition, debian linux +2 more +4 moreSpoofing of From field in several screensCVE-2020-1765Fix available3.5 Low