CVE-2023-6254
Assigner: OTRS
Published: 2023-11-27T09:44:00.273Z
State: PUBLISHED
affected: defaultStatus: unaffected
modules: AgentInterface
ExternalInterface
product: OTRS
vendor: OTRS AG
versions: lessThanOrEqual: 8.0.37
status: affected
version: 8.0.x
versionType: Patch
credits: type: reporter
value: Special thanks to Matthias Püschel for reporting these vulnerability.
datePublic: 2023-11-27T08:00:00.000Z
descriptions: supportingMedia: base64: no
type: text/html
value: A Vulnerability in OTRS AgentInterface and ExternalInterface allows the reading of plain text passwords which are send back to the client in the server response-<br><p>This issue affects OTRS: from 8.0.X through 8.0.37.</p>
value: A Vulnerability in OTRS AgentInterface and ExternalInterface allows the reading of plain text passwords which are send back to the client in the server response-
This issue affects OTRS: from 8.0.X through 8.0.37.


impacts: capecId: CAPEC-555
descriptions: value: CAPEC-555 Remote Services with Stolen Credentials
metrics: cvssV3_1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: NONE
baseScore: 8.1
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
version: 3.1
format: CVSS
scenarios: value: GENERAL
problemTypes: descriptions: cweId: CWE-522
description: CWE-522 Insufficiently Protected Credentials
type: CWE
solutions: supportingMedia: base64: no
type: text/html
value: Update to OTRS Patch 2023.1.1<br>
value: Update to OTRS Patch 2023.1.1

source: advisory: OSA-2023-11
defect: Issue#1390
Ticket#2023083042000825
discovery: USER
title: Password is send back to client
x_generator: engine: Vulnogram 0.1.0-dev