VDB
CVE-2023-38060
CVE-2023-38060
PUBLISHED
CVSS 6.300000190734863 MEDIUM
Improper Input Validation vulnerability in the ContentType parameter for attachments on TicketCreate or TicketUpdate operations of the OTRS Generic Interface modules allows any authenticated attacker to to perform an host header injection for the ContentType header of the attachment. This issue affects OTRS: from 7.0.X before 7.0.45, from 8.0.X before 8.0.35; ((OTRS)) Community Edition: from 6.0.1 through 6.0.34.
EPSS 0.23% · 45.6th percentile
Risk Scores
CVSS v3.1
6.300000190734863
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
EPSS Score
0.23%
45.6th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| OTRS AG | ((OTRS)) Community Edition | 6.0.1 |
| otrs | otrs | 6.0.1, 7.0.0, 8.0.0 |
| OTRS AG | OTRS | 8.0.x, * |
Timeline
- Jul 24, 2023 CVE Published
- Jul 25, 2023 EPSS Score
- Aug 28, 2023 EPSS Score
- Oct 1, 2023 EPSS Score
- Dec 8, 2023 EPSS Score
- Jan 11, 2024 EPSS Score
- Feb 14, 2024 EPSS Score
- Mar 19, 2024 EPSS Score
- Apr 23, 2024 EPSS Score
- May 27, 2024 EPSS Score
- Aug 3, 2024 EPSS Score
- Sep 6, 2024 EPSS Score