VDB
CVE-2023-38060
CVE-2023-38060
PUBLISHED
CVSS 6.300000190734863 MEDIUM
Improper Input Validation vulnerability in the ContentType parameter for attachments on TicketCreate or TicketUpdate operations of the OTRS Generic Interface modules allows any authenticated attacker to to perform an host header injection for the ContentType header of the attachment. This issue affects OTRS: from 7.0.X before 7.0.45, from 8.0.X before 8.0.35; ((OTRS)) Community Edition: from 6.0.1 through 6.0.34.
EPSS 0.68% · 50.8th percentile
Risk Scores
CVSS 3.1
6.300000190734863
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
EPSS Score
0.68%
50.8th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| OTRS AG | ((OTRS)) Community Edition | 6.0.1 |
| otrs | otrs | 6.0.1, 7.0.0, 8.0.0 |
| OTRS AG | OTRS | 8.0.x, * |
Timeline
- Jul 24, 2023 CVE Published
- Jul 25, 2023 EPSS Score
- Aug 29, 2023 EPSS Score
- Oct 3, 2023 EPSS Score
- Dec 11, 2023 EPSS Score
- Jan 15, 2024 EPSS Score
- Feb 19, 2024 EPSS Score
- Mar 24, 2024 EPSS Score
- Apr 28, 2024 EPSS Score
- Jul 7, 2024 EPSS Score
- Aug 10, 2024 EPSS Score
- Sep 14, 2024 EPSS Score