Vulnerability · Published Mar 20, 2023 · Assigned by OTRS
CVE-2023-1250Code execution through ACL creation
High 7.4
In plain English
A high-severity improper input validation in OTRS from OTRS AG. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 22% of all known vulnerabilities).
Official description
Improper Input Validation vulnerability in OTRS AG OTRS (ACL modules), OTRS AG ((OTRS)) Community Edition (ACL modules) allows Local Execution of Code. When creating/importing an ACL it was possible to inject code that gets executed via manipulated comments and ACL-names This issue affects OTRS: from 7.0.X before 7.0.42, from 8.0.X before 8.0.31; ((OTRS)) Community Edition: from 6.0.1 through 6.0.34.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu:22.04:LTS | otrs2 | no fix listed | UBUNTU-CVE-2023-1250 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| OTRS AG | OTRS | 7.0.x – before 7.0.428.0.x – before 8.0.31 |
| OTRS AG | ((OTRS)) Community Edition | 6.0.1 – through 6.0.34 |
Weakness: CWE-20 · Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N