CVE-2008-7281

OTRS < 2.2.7 - Unauthorized Exposure of Bcc Recipient E-mail Addresses

Title source: llm
STIX 2.1

Description

Open Ticket Request System (OTRS) before 2.2.7 sends e-mail containing a Bcc header field that lists the Blind Carbon Copy recipients, which allows remote attackers to obtain potentially sensitive e-mail address information by reading this field.

References (3)

Core 3
Core References
Various Sources x_refsource_confirm
http://bugs.otrs.org/show_bug.cgi?id=1882
Patch x_refsource_confirm
http://bugs.otrs.org/show_bug.cgi?id=2814

Scores

EPSS 0.0173
EPSS Percentile 74.9%

Details

CWE
CWE-200
Status published
Products (29)
otrs/otrs 0.5 beta1 (8 CPE variants)
otrs/otrs 1.0 rc1 (3 CPE variants)
otrs/otrs 1.0.0
otrs/otrs 1.0.1
otrs/otrs 1.0.2
otrs/otrs 1.1 rc1
otrs/otrs 1.1.0 rc1 (2 CPE variants)
otrs/otrs 1.1.1
otrs/otrs 1.1.2
otrs/otrs 1.1.3
... and 19 more
Published Mar 18, 2011
Tracked Since Feb 18, 2026