VDB
CVE-2023-38060
CVE-2023-38060
PUBLISHED
CVSS 6.300000190734863 MEDIUM
Improper Input Validation vulnerability in the ContentType parameter for attachments on TicketCreate or TicketUpdate operations of the OTRS Generic Interface modules allows any authenticated attacker to to perform an host header injection for the ContentType header of the attachment. This issue affects OTRS: from 7.0.X before 7.0.45, from 8.0.X before 8.0.35; ((OTRS)) Community Edition: from 6.0.1 through 6.0.34.
EPSS 0.23% · 45.7th percentile
Risk Scores
CVSS 3.1
6.300000190734863
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
EPSS Score
0.23%
45.7th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| OTRS AG | ((OTRS)) Community Edition | 6.0.1 |
| otrs | otrs | 6.0.1, 7.0.0, 8.0.0 |
| OTRS AG | OTRS | 8.0.x, * |
Timeline
- Jul 24, 2023 CVE Published
- Jul 25, 2023 EPSS Score
- Aug 28, 2023 EPSS Score
- Oct 1, 2023 EPSS Score
- Dec 9, 2023 EPSS Score
- Jan 12, 2024 EPSS Score
- Feb 15, 2024 EPSS Score
- Mar 20, 2024 EPSS Score
- Apr 23, 2024 EPSS Score
- Jun 30, 2024 EPSS Score
- Aug 4, 2024 EPSS Score
- Sep 7, 2024 EPSS Score