CVE-2025-24387 — Sensitive Cookie with Improper SameSite Attribute in AG Otrs

CWE-1275 — Sensitive Cookie with Improper SameSite AttributeCWE-352 — Cross-Site Request Forgery3 documents3 sources
Severity
6.5MEDIUMNVD
CNA4.8
EPSS
0.0%
top 91.43%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Otrs AG OtrsOtrs
Timeline
PublishedMar 10

Description

A vulnerability in OTRS Application Server allows session hijacking due to missing attributes for sensitive cookie settings in HTTPS sessions. A request to an OTRS endpoint from a possible malicious web site, would send the authentication cookie, performing an unwanted read operation. This issue affects: * OTRS 7.0.X * OTRS 8.0.X * OTRS 2023.X * OTRS 2024.X * OTRS 2025.x

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:NExploitability: 2.8 | Impact: 3.6

Affected Packages2 packages

▶NVDotrs/otrs7.0.0 — 2025.1.2
▶CVEListV5otrs_ag/otrs2025.x — 2025.1.2+4

🔴Vulnerability Details

2
CVEList
Missing CSRF protection↗2025-03-10
▶
GHSA
GHSA-9f25-wfqc-782v: A vulnerability in OTRS Application Server allows session hijacking due to missing attributes for sensitive cookie settings in HTTPS sessions↗2025-03-10
▶
CVE-2025-24387 — Otrs AG Otrs vulnerability | cvebase