Skip to content
CVE PROGRAM SOURCE RECORD5.3 Medium

CVE-2023-38059

External pictures can be loaded even if not allowed by configuration

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
OTRS

Description

The loading of external images is not blocked, even if configured, if the attacker uses protocol-relative URL in the payload. This can be used to retreive the IP of the user.This issue affects OTRS: from 7.0.X before 7.0.47, from 8.0.X before 8.0.37; ((OTRS)) Community Edition: from 6.0.X through 6.0.34.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

OTRS AG OTRS

Default version status: affected

  • 7.0.x to < 7.0.47affected
  • 8.0.x to < 8.0.37affected

OTRS AG ((OTRS)) Community Edition

Default version status: unaffected

  • 6.0.x to ≤ 6.0.34affected

References