Vulnerability · Published Jun 16, 2025 · Assigned by OTRS

CVE-2025-24388Unsafe handling of AJAX calls

Low 3.8

In plain English

A low-severity security flaw in OTRS from OTRS AG. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 20% of all known vulnerabilities).

Severity (CVSS 3.1)3.8Low

Exploit odds (30 days)0.3%top 79.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A vulnerability in the OTRS Admin Interface and Agent Interface (versions before OTRS 8) allow parameter injection due to for an autheniticated agent or admin user. This issue affects: * OTRS 7.0.X * OTRS 8.0.X * OTRS 2023.X * OTRS 2024.X * OTRS 2025.X * ((OTRS)) Community Edition: 6.0.x Products based on the ((OTRS)) Community Edition also very likely to be affected

Affected products (as reported)

Vendor	Product	Versions
OTRS AG	OTRS	7.0.x8.0.x2023.x2024.x2025.x – through 2025.5.1
OTRS AG	((OTRS)) Community Edition	6.0.x

Weakness: CWE-184 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L

References

https://otrs.com/release-notes/otrs-security-advisory-2025-06/