{"id":"CVE-2023-38056","state":"PUBLISHED","title":"Code execution via System Configuration","description":"Improper Neutralization of commands allowed to be executed via OTRS System Configuration e.g. SchedulerCronTaskModule using UnitTests modules allows any authenticated attacker with admin privileges local execution of Code.This issue affects OTRS: from 7.0.X before 7.0.45, from 8.0.X before 8.0.35; ((OTRS)) Community Edition: from 6.0.1 through 6.0.34.\n\n","publishedAt":"2023-07-24T08:27:13.127Z","updatedAt":"2024-10-23T17:49:19.541Z","severity":{"score":7.2,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","source":"OTRS"},"assigner":"OTRS","products":["OTRS AG OTRS","OTRS AG ((OTRS)) Community Edition"],"affected":[{"vendor":"OTRS AG","product":"OTRS","defaultStatus":"affected","versions":[{"version":"7.0.x","status":"affected","lessThan":"7.0.45","versionType":"Patch"},{"version":"8.0.x","status":"affected","lessThan":"8.0.35","versionType":"Patch"}],"modules":["System Configuration","UnitTests"]},{"vendor":"OTRS AG","product":"((OTRS)) Community Edition","defaultStatus":"affected","versions":[{"version":"6.0.1","status":"affected","lessThanOrEqual":"6.0.34","versionType":"All"}]}],"references":["https://otrs.com/release-notes/otrs-security-advisory-2023-05/"],"weaknesses":["CWE-78"],"ingestedAt":"2026-10-29T20:06:08.715Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2023/38xxx/CVE-2023-38056.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2023-38056","state":"PUBLISHED","datePublished":"2023-07-24T08:27:13.127Z","dateUpdated":"2024-10-23T17:49:19.541Z","assignerShortName":"OTRS","assignerOrgId":"2e1bf29f-dc29-4ed8-830c-7b9348b6f0e8","dateReserved":"2023-07-12T08:05:38.780Z"},"containers":{"cna":{"title":"Code execution via System Configuration ","descriptions":[{"lang":"en","value":"Improper Neutralization of commands allowed to be executed via OTRS System Configuration e.g. SchedulerCronTaskModule using UnitTests modules allows any authenticated attacker with admin privileges local execution of Code.This issue affects OTRS: from 7.0.X before 7.0.45, from 8.0.X before 8.0.35; ((OTRS)) Community Edition: from 6.0.1 through 6.0.34.\n\n"}],"affected":[{"vendor":"OTRS AG","product":"OTRS","defaultStatus":"affected","versions":[{"version":"7.0.x","status":"affected","lessThan":"7.0.45","versionType":"Patch"},{"version":"8.0.x","status":"affected","lessThan":"8.0.35","versionType":"Patch"}],"modules":["System Configuration","UnitTests"]},{"vendor":"OTRS AG","product":"((OTRS)) Community Edition","defaultStatus":"affected","versions":[{"version":"6.0.1","status":"affected","lessThanOrEqual":"6.0.34","versionType":"All"}]}],"references":[{"url":"https://otrs.com/release-notes/otrs-security-advisory-2023-05/"}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-78","description":"CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"OTRS","orgId":"2e1bf29f-dc29-4ed8-830c-7b9348b6f0e8","dateUpdated":"2023-07-24T08:27:26.270Z"},"credits":[{"lang":"en","type":"finder","user":"00000000-0000-4000-9000-000000000000","value":"Special thanks to Tim Püttmanns for reporting these vulnerability."}],"datePublic":"2023-07-24T07:00:00.000Z","impacts":[{"capecId":"CAPEC-549","descriptions":[{"lang":"en","value":"CAPEC-549 Local Execution of Code"}]}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"Update to OTRS 8.0.35 or OTRS 7.0.45<br>"}],"value":"Update to OTRS 8.0.35 or OTRS 7.0.45\n"}],"source":{"advisory":"OSA-2023-05","defect":["1025","Ticket#2023041142000636"],"discovery":"EXTERNAL"},"x_generator":{"engine":"Vulnogram 0.1.0-dev"}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://otrs.com/release-notes/otrs-security-advisory-2023-05/","tags":["x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-02T17:30:12.960Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-10-23T17:47:42.741098Z","id":"CVE-2023-38056","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-10-23T17:49:19.541Z"}}]}}}