Vulnerability · Published Jul 24, 2023 · Assigned by OTRS
CVE-2023-38060Host header injection by attachments in web service
Medium 6.3
In plain English
A medium-severity improper input validation in OTRS from OTRS AG. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 53% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Improper Input Validation vulnerability in the ContentType parameter for attachments on TicketCreate or TicketUpdate operations of the OTRS Generic Interface modules allows any authenticated attacker to to perform an host header injection for the ContentType header of the attachment. This issue affects OTRS: from 7.0.X before 7.0.45, from 8.0.X before 8.0.35; ((OTRS)) Community Edition: from 6.0.1 through 6.0.34.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | znuny | no fix listed | DEBIAN-CVE-2023-38060 |
| Debian:13 | znuny | 6.5.3-1 | DEBIAN-CVE-2023-38060 |
| Debian:14 | znuny | 6.5.3-1 | DEBIAN-CVE-2023-38060 |
| Ubuntu:22.04:LTS | otrs2 | no fix listed | UBUNTU-CVE-2023-38060 |
| Ubuntu:24.04:LTS | znuny | no fix listed | UBUNTU-CVE-2023-38060 |
| Ubuntu:25.10 | znuny | no fix listed | UBUNTU-CVE-2023-38060 |
| Ubuntu:26.04:LTS | znuny | no fix listed | UBUNTU-CVE-2023-38060 |
| Ubuntu:26.10 | znuny | no fix listed | UBUNTU-CVE-2023-38060 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| OTRS AG | OTRS | 7.0.x – before 7.0.458.0.x – before 8.0.35 |
| OTRS AG | ((OTRS)) Community Edition | 6.0.1 – through 6.0.34 |
Weakness: CWE-20 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L