CVE-2024-23791

MEDIUM

OTRS 7.0.0-7.0.48 8.0.0-8.0.37 2023.0-2023.1.1 - Sensitive Information Disclosure in Elasticsearch Index Logs

Title source: llm

Description

Insertion of debug information into log file during building the elastic search index allows reading of sensitive information from articles.This issue affects OTRS: from 7.0.X through 7.0.48, from 8.0.X through 8.0.37, from 2023.X through 2023.1.1.

References (1)

Core 1

Core References

Vendor Advisory vendor-advisory

https://otrs.com/release-notes/otrs-security-advisory-2024-02/

Scores

CVSS v3 4.9

EPSS 0.0052

EPSS Percentile 39.6%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-532

Status published

Products (1)

otrs/otrs 7.0.0 - 7.0.49

Published Jan 29, 2024

Tracked Since Feb 18, 2026