CVE-2023-38060

CVSS 3.1 Score 6.3 of 10 (medium)

Details

Published Jul 24, 2023
Updated: Aug 31, 2023
CWE ID 74
CWE ID 20

Summary

CVE-2023-38060 is an Improper Input Validation vulnerability found in the ContentType parameter for attachments on TicketCreate or TicketUpdate operations of the OTRS Generic Interface modules. This vulnerability allows any authenticated attacker to perform a host header injection for the ContentType header of the attachment. The affected products include OTRS versions from 7.0.X before 7.0.45 and from 8.0.X before 8.0.35, as well as ((OTRS)) Community Edition versions from 6.0.1 through 6.0.34. To remediate this issue, users should upgrade to OTRS version 7.0.45 or 8.0.35, or ((OTRS)) Community Edition version 6.0.35, as appropriate. The danger posed by this vulnerability is rated as MEDIUM, with a base score of 6.3 out of 10, and it requires low privileges and no user interaction to exploit over the network, potentially leading to low impacts on integrity and confidentiality of affected systems.

Leverage our Vulnerability Intelligence module to secure your systems now - get detailed insights on CVE-2024-37364. Book your demo today.

Share

Explore Beyond the CVE Basics with Recorded Future's Vulnerability Intelligence

Note: This is just a basic overview providing quick insights into CVE-2023-38060 information. Gain full access to comprehensive CVE data, risk scores, prioritization, and mitigation data through Recorded Future's Vulnerability Intelligence:
  • Prioritize with Risk-Based Scoring
  • Explore the Extensive Vulnerability Database
  • Receive Early Alerts on Emerging CVEs
  • Focus on Critical Exploitable Vulnerabilities
  • Streamline Remediation with Integration Options