CVE-2024-23790

CVSS 3.1 Score 9.8 of 10 (high)

Details

Published Jan 29, 2024

Updated: Feb 2, 2024

CWE ID 354

CWE ID 20

Summary

CVE-2024-23790 is an Input Validation vulnerability affecting OTRS versions 7.0.X through 7.0.48, 8.0.X through 8.0.37, and 2023 through 2023.1.1. The flaw lies in the upload functionality for user avatars, where a missing filetype check allows attackers to manipulate the system by uploading unsupported files. This can result in functionality misuse and potential security breaches. It is strongly recommended that users of these affected versions upgrade to the latest patches to mitigate this risk.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.

OTRS

Affected Vendors

otrs)

Advisories, Assessments, and Mitigations

https://app.recordedfuture.com/live/sc/entity/uPPYyX
https://www.cve.org/CVERecord?id=CVE-2024-23790
https://nvd.nist.gov/vuln/detail/CVE-2024-23790

Back to Vulnerability Database