A vulnerability was found in OTRS (Service Management Software). It has been classified as critical. This affects some unknown functionality of the component Mail Client. The manipulation with an unknown input leads to a input validation vulnerability. CWE is classifying the issue as CWE-20. The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. This is going to have an impact on confidentiality. The summary by CVE is:

The AgentTicketForward feature in Open Ticket Request System (OTRS) before 2.4.7 does not properly remove inline images from HTML e-mail messages, which allows remote attackers to obtain potentially sensitive image information in opportunistic circumstances by reading a forwarded message in a standard e-mail client.

The weakness was disclosed 03/18/2011 (Website). The advisory is shared at source.otrs.org. This vulnerability is uniquely identified as CVE-2010-4766. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Neither technical details nor an exploit are publicly available.

Upgrading to version 0.5 eliminates this vulnerability.

The vulnerability is also documented in the databases at X-Force (66335) and Vulnerability Center (SBV-30785†).

Productinfo

Type

• Service Management Software

Name

• OTRS

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion