CVE-2025-24388

LOW

OTRS 7.0.x 8.0.x 2023.x 2024.x 2025.x and ((OTRS)) Community Edition 6.0.x - Authenticated Parameter Injection

Title source: llm
STIX 2.1

Description

A vulnerability in the OTRS Admin Interface and Agent Interface (versions before OTRS 8) allow parameter injection due to for an autheniticated agent or admin user. This issue affects: * OTRS 7.0.X * OTRS 8.0.X * OTRS 2023.X * OTRS 2024.X * OTRS 2025.X * ((OTRS)) Community Edition: 6.0.x Products based on the ((OTRS)) Community Edition also very likely to be affected

References (1)

Core 1

Scores

CVSS v3 3.8
EPSS 0.0024
EPSS Percentile 14.6%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-184
Status published
Products (6)
OTRS AG/((OTRS)) Community Edition 6.0.x
OTRS AG/OTRS 2023.x
OTRS AG/OTRS 2024.x
OTRS AG/OTRS 2025.x - 2025.5.1
OTRS AG/OTRS 7.0.x
OTRS AG/OTRS 8.0.x
Published Jun 16, 2025
Tracked Since Feb 18, 2026