Description
Open Ticket Request System (OTRS) before 3.0.0-beta6 adds email-notification-ext articles to tickets during processing of event-based notifications, which allows remote authenticated users to obtain potentially sensitive information by reading a ticket.
References (2)
Core 2
Core References
Various Sources x_refsource_confirm
http://source.otrs.org/viewvc.cgi/otrs/CHANGES?revision=1.1807
Patch x_refsource_confirm
http://bugs.otrs.org/show_bug.cgi?id=5975
Scores
EPSS
0.0117
EPSS Percentile
63.7%
Details
CWE
CWE-200
Status
published
Products (29)
otrs/otrs
0.5 beta1 (8 CPE variants)
otrs/otrs
1.0 rc1 (3 CPE variants)
otrs/otrs
1.0.0
otrs/otrs
1.0.1
otrs/otrs
1.0.2
otrs/otrs
1.1 rc1
otrs/otrs
1.1.0 rc1 (2 CPE variants)
otrs/otrs
1.1.1
otrs/otrs
1.1.2
otrs/otrs
1.1.3
... and 19 more
Published
Mar 18, 2011
Tracked Since
Feb 18, 2026