Skip to content
CVE PROGRAM SOURCE RECORD6.3 Medium

CVE-2023-38060

Host header injection by attachments in web service

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
OTRS

Description

Improper Input Validation vulnerability in the ContentType parameter for attachments on TicketCreate or TicketUpdate operations of the OTRS Generic Interface modules allows any authenticated attacker to to perform an host header injection for the ContentType header of the attachment.  This issue affects OTRS: from 7.0.X before 7.0.45, from 8.0.X before 8.0.35; ((OTRS)) Community Edition: from 6.0.1 through 6.0.34.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

OTRS AG OTRS

Default version status: affected

  • 7.0.x to < 7.0.45affected
  • 8.0.x to < 8.0.35affected

OTRS AG ((OTRS)) Community Edition

Default version status: affected

  • 6.0.1 to ≤ 6.0.34affected

References