CVE-2025-24387: A vulnerability in OTRS Application Server allows session hijacking due to missing attributes for sensitive cookie settings in HTTPS sessions. A request to an…

PriorityP433medium6.5CVSS 3.1

AVNACLPRNUIRSUCHINAN

EPSS

0.14%

3.8th percentile

A vulnerability in OTRS Application Server allows session hijacking due to missing attributes for sensitive
cookie settings in HTTPS sessions. A request to an OTRS endpoint from a possible malicious web site, would send the authentication cookie, performing an unwanted read operation.


This issue affects:

* OTRS 7.0.X
* OTRS 8.0.X
* OTRS 2023.X
* OTRS 2024.X
* OTRS 2025.x

Affected

6 ranges

Vendor	Product	Version range	Fixed in
otrs	otrs	7.0.0 – 2025.1.2	—
otrs_ag	otrs	—	—
otrs_ag	otrs	—	—
otrs_ag	otrs	—	—
otrs_ag	otrs	—	—
otrs_ag	otrs	2025.x – 2025.1.2	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.