CVE-2010-4766

OTRS < 2.4.7 - Information Exposure via AgentTicketForward Inline Image Handling

Title source: llm
STIX 2.1

Description

The AgentTicketForward feature in Open Ticket Request System (OTRS) before 2.4.7 does not properly remove inline images from HTML e-mail messages, which allows remote attackers to obtain potentially sensitive image information in opportunistic circumstances by reading a forwarded message in a standard e-mail client.

References (2)

Core 2
Core References
Exploit x_refsource_confirm
http://bugs.otrs.org/show_bug.cgi?id=4818

Scores

EPSS 0.0109
EPSS Percentile 61.5%

Details

CWE
CWE-20
Status published
Products (29)
otrs/otrs 0.5 beta1 (8 CPE variants)
otrs/otrs 1.0 rc1 (3 CPE variants)
otrs/otrs 1.0.0
otrs/otrs 1.0.1
otrs/otrs 1.0.2
otrs/otrs 1.1 rc1
otrs/otrs 1.1.0 rc1 (2 CPE variants)
otrs/otrs 1.1.1
otrs/otrs 1.1.2
otrs/otrs 1.1.3
... and 19 more
Published Mar 18, 2011
Tracked Since Feb 18, 2026