OTRS/otrs

GitHub

github.com

www.otrs.com

Unavailable

This project is no longer available (or publicly accessible) from GitHub

Releases329

Frequency2 weeks 5 days

Last Release over 5 years ago

Stars858

((OTRS)) Community Edition is one of the most flexible web-based ticketing systems used for Customer Service, Help Desk, IT Service Management. Please note that ((OTRS)) Community Edition offers limited OTRS functionality.

CVE History

CVE	Published	CVSS v3	CVSS v2
CVE-2018-16587 ↗	Sep 28, 2018Friday, 28 September 2018, 00:29	—	5.8 MEDIUM
In Open Ticket Request System (OTRS) 4.0.x before 4.0.32, 5.0.x before 5.0.30, and 6.0.x before 6.0.11, an attacker could send a malicious email to an OTRS system. If a user with admin permissions opens it, it causes deletions of arbitrary files that the OTRS web server user has write access to.
CVE-2018-16586 ↗	Sep 28, 2018Friday, 28 September 2018, 00:29	—	4.3 MEDIUM
In Open Ticket Request System (OTRS) 4.0.x before 4.0.32, 5.0.x before 5.0.30, and 6.0.x before 6.0.11, an attacker could send a malicious email to an OTRS system. If a logged in user opens it, the email could cause the browser to load external image or CSS resources.
CVE-2017-17476 ↗	Dec 20, 2017Wednesday, 20 December 2017, 17:29	—	6.8 MEDIUM
Open Ticket Request System (OTRS) 4.0.x before 4.0.28, 5.0.x before 5.0.26, and 6.0.x before 6.0.3, when cookie support is disabled, might allow remote attackers to hijack web sessions and consequently gain privileges via a crafted email.
CVE-2014-1471 ↗	Feb 4, 2014Tuesday, 4 February 2014, 21:55	—	7.5 HIGH
SQL injection vulnerability in the StateGetStatesByType function in Kernel/System/State.pm in Open Ticket Request System (OTRS) 3.1.x before 3.1.19, 3.2.x before 3.2.14, and 3.3.x before 3.3.4 allows remote attackers to execute arbitrary SQL commands via vectors related to a ticket search URL.
CVE-2014-1694 ↗	Feb 4, 2014Tuesday, 4 February 2014, 21:55	—	6.8 MEDIUM
Multiple cross-site request forgery (CSRF) vulnerabilities in (1) CustomerPreferences.pm, (2) CustomerTicketMessage.pm, (3) CustomerTicketProcess.pm, and (4) CustomerTicketZoom.pm in Kernel/Modules/ in Open Ticket Request System (OTRS) 3.1.x before 3.1.19, 3.2.x before 3.2.14, and 3.3.x before 3.3.4 allow remote attackers to hijack the authentication of arbitrary users for requests that (5) create tickets or (6) send follow-ups to existing tickets.