CVE-2023-6254 — Insufficiently Protected Credentials in AG Otrs

CWE-522 — Insufficiently Protected Credentials4 documents4 sources
Severity
7.5HIGHNVD
CNA8.1
EPSS
0.2%
top 60.68%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Otrs AG OtrsOtrs
Timeline
PublishedNov 27

Description

A Vulnerability in OTRS AgentInterface and ExternalInterface allows the reading of plain text passwords which are send back to the client in the server response- This issue affects OTRS: from 8.0.X through 8.0.37.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitability: 3.9 | Impact: 3.6

Affected Packages2 packages

▶NVDotrs/otrs8.0.1 — 8.0.37
▶CVEListV5otrs_ag/otrs8.0.x — 8.0.37

🔴Vulnerability Details

3
GHSA
GHSA-8vrv-grfv-cpq4: A Vulnerability in OTRS AgentInterface and ExternalInterface allows the reading of plain text passwords which are send back to the client in the serve↗2023-11-27
▶
CVEList
Password is send back to client↗2023-11-27
▶
OSV
CVE-2023-6254: A Vulnerability in OTRS AgentInterface and ExternalInterface allows the reading of plain text passwords which are send back to the client in the serve↗2023-11-27
▶
CVE-2023-6254 — Insufficiently Protected Credentials | cvebase