CVE-2024-23792
CVSS 3.1 Score 6.5 of 10 (medium)
Details
Published Jan 29, 2024
Updated: Feb 2, 2024
CWE ID 287
Summary
CVE-2024-23792 is a vulnerability in OTRS that allows logged-in attackers to impersonate original users and add attachments to their ticket comments. The malicious user must know the UUID of the comment being created. This means they can add additional files to a comment while the legitimate user is still completing it. This issue affects various OTRS versions, including those from 7.0.X through 7.0.48, 8.0.X through 8.0.37, and 2023.X through 2023.1.1. This vulnerability poses a risk of data confusion and unintended file sharing.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Share
Affected Products
- OTRS
Affected Vendors
- otrs)
Advisories, Assessments, and Mitigations
Prioritize, Pinpoint, and Act to Prevent Vulnerability Exploits with Recorded Future
Note: This is just a basic overview providing quick insights into CVE-2024-23792 information. Gain full access to comprehensive CVE data, third party vulnerabilities, compromised credentials and more with Recorded Future
- Gain complete coverage of your cyber, third party, and physical attack surface
- Proactively mitigate threats before they turn into costly attacks
- Make fast, effective, data-driven decisions