Vulnerability · Published Oct 16, 2023 · Assigned by OTRS
CVE-2023-5422SSL Certificates are not checked for E-Mail Handling
High 8.7
In plain English
A high-severity improper certificate validation in OTRS from OTRS AG. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 26% of all known vulnerabilities).
Official description
The functions to fetch e-mail via POP3 or IMAP as well as sending e-mail via SMTP use OpenSSL for static SSL or TLS based communication. As the SSL_get_verify_result() function is not used the certificated is trusted always and it can not be ensured that the certificate satisfies all necessary security requirements. This could allow an attacker to use an invalid certificate to claim to be a trusted host, use expired certificates, or conduct other attacks that could be detected if the certificate is properly validated. This issue affects OTRS: from 7.0.X before 7.0.47, from 8.0.X before 8.0.37; ((OTRS)) Community Edition: from 6.0.X through 6.0.34.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu:22.04:LTS | otrs2 | no fix listed | UBUNTU-CVE-2023-5422 |
| Ubuntu:24.04:LTS | znuny | no fix listed | UBUNTU-CVE-2023-5422 |
| Ubuntu:25.10 | znuny | no fix listed | UBUNTU-CVE-2023-5422 |
| Ubuntu:26.04:LTS | znuny | no fix listed | UBUNTU-CVE-2023-5422 |
| Ubuntu:26.10 | znuny | no fix listed | UBUNTU-CVE-2023-5422 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| OTRS AG | OTRS | 7.0.x – before 7.0.478.0.x – before 8.0.37 |
| OTRS AG | ((OTRS)) Community Edition | 6.0.x – through 6.0.34 |
Weakness: CWE-295 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N