CVEvulnerability
CVE-2019-9892
6.5 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2019-05-22
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 6.5 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- CVSS 2.0 ([email protected])
- 4.0 MEDIUM — AV:N/AC:L/Au:S/C:P/I:N/A:N
- Weaknesses
- CWE-91
Description
An issue was discovered in Open Ticket Request System (OTRS) 5.x through 5.0.34, 6.x through 6.0.17, and 7.x through 7.0.6. An attacker who is logged into OTRS as an agent user with appropriate permissions may try to import carefully crafted Report Statistics XML that will result in reading of arbitrary files on the OTRS filesystem.
Affected configurations
• otrs otrs (>= 5.0.0 <= 5.0.34)
• otrs otrs (>= 6.0.0 <= 6.0.17)
• otrs otrs (>= 7.0.0 <= 7.0.6)
• debian debian linux 8.0
Related
Weakness · CWE (1)
- CWE-91 XML Injection weakness
References
- http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00038.html Broken Link
- http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00066.html Broken Link
- http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00077.html Broken Link
- https://community.otrs.com/security-advisory-2019-04-security-update-for-otrs-framework/ Vendor Advisory
- https://lists.debian.org/debian-lts-announce/2019/05/msg00003.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00038.html Broken Link
- http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00066.html Broken Link
- http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00077.html Broken Link
- https://community.otrs.com/security-advisory-2019-04-security-update-for-otrs-framework/ Vendor Advisory
- https://lists.debian.org/debian-lts-announce/2019/05/msg00003.html Mailing List, Third Party Advisory