Headline

CVE-2019-18180: Security Advisory 2019-15: Security Update for OTRS Framework - ((OTRS)) Community Edition

Improper Check for filenames with overly long extensions in PostMaster (sending in email) or uploading files (e.g. attaching files to mails) of ((OTRS)) Community Edition and OTRS allows an remote attacker to cause an endless loop. This issue affects: OTRS AG: ((OTRS)) Community Edition 5.0.x version 5.0.38 and prior versions; 6.0.x version 6.0.23 and prior versions. OTRS AG: OTRS 7.0.x version 7.0.12 and prior versions.

4 years ago

CVE

Open in Source

#vulnerability #dos

Release Notes

OTRS Group, the world’s leading provider of the OTRS service management suite, including the fully managed OTRS solution and the ITIL® V3-compliant IT service management software OTRS::ITSM.

15/11/2019
Security Advisories

November 15, 2019 — Please read carefully and check if the version of your OTRS system is affected by this vulnerability.

Security Advisory Details

ID: OSA-2019-15
Date: 2019-11-15
Title: Denial of service
Severity: Medium
Product: OTRS 7.0.x, OTRS 6.0.x, OTRS 5.0.x
Fixed in: OTRS 7.0.13, OTRS 6.0.24, OTRS 5.0.39
FULL CVSS v3 VECTOR: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:R
References: CVE-2019-18180

Vulnerability Description

This advisory covers vulnerabilities discovered in the OTRS framework.

Privilege Escalation

OTRS can be put into an endless loop by providing filenames with overly long extensions. This applies to the PostMaster (sending in email) and also upload (attaching files to mails, for example).

Affected by this vulnerability are all releases of OTRS 7.0.x up to and including 7.0.12, OTRS 6.0.x up to and including 6.0.23, OTRS 5.0.x up to and including 5.0.38.

Release Name:

Security Advisory 2019-15: Security Update for OTRS Framework

PGP Key