Skip to content
CVE PROGRAM SOURCE RECORD7.4 High

CVE-2023-1250

Code execution through ACL creation

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
OTRS

Description

Improper Input Validation vulnerability in OTRS AG OTRS (ACL modules), OTRS AG ((OTRS)) Community Edition (ACL modules) allows Local Execution of Code. When creating/importing an ACL it was possible to inject code that gets executed via manipulated comments and ACL-names This issue affects OTRS: from 7.0.X before 7.0.42, from 8.0.X before 8.0.31; ((OTRS)) Community Edition: from 6.0.1 through 6.0.34.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

OTRS AG OTRS

Default version status: affected

  • 7.0.x to < 7.0.42affected
  • 8.0.x to < 8.0.31affected

OTRS AG ((OTRS)) Community Edition

Default version status: affected

  • 6.0.1 to ≤ 6.0.34affected

References