Upstream information
Description
In Open Ticket Request System (OTRS) 4.0.x before 4.0.32, 5.0.x before 5.0.30, and 6.0.x before 6.0.11, an attacker could send a malicious email to an OTRS system. If a user with admin permissions opens it, it causes deletions of arbitrary files that the OTRS web server user has write access to.SUSE information
Overall state of this security issue: Resolved
This issue is currently rated as having moderate severity.
National Vulnerability Database | |
---|---|
Base Score | 5.8 |
Vector | AV:N/AC:M/Au:N/C:N/I:P/A:P |
Access Vector | Network |
Access Complexity | Medium |
Authentication | None |
Confidentiality Impact | None |
Integrity Impact | Partial |
Availability Impact | Partial |
National Vulnerability Database | |
---|---|
Base Score | 6.5 |
Vector | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N |
Attack Vector | Network |
Attack Complexity | Low |
Privileges Required | None |
User Interaction | Required |
Scope | Unchanged |
Confidentiality Impact | None |
Integrity Impact | High |
Availability Impact | None |
CVSSv3 Version | 3 |
SUSE Security Advisories:
- openSUSE-SU-2018:3005-1, published Fri Dec 8 15:48:40 2023
List of released packages
Product(s) | Fixed package version(s) | References |
---|---|---|
SUSE Package Hub 15 |
| Patchnames: openSUSE-2019-748 |
openSUSE Leap 15.0 |
| Patchnames: openSUSE-2019-748 |
SUSE Timeline for this CVE
CVE page created: Mon Sep 24 21:17:17 2018CVE page last modified: Fri Dec 8 17:18:23 2023