CVE-2019-18180 Denial of service
Remote attackers can cause an endless loop and denial of service in OTRS by submitting filenames with overly long extensions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-18180?
CVE-2019-18180 is a medium-severity denial of service vulnerability in Otrs Otrs, published on 5 Dec 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Improper Check for filenames with overly long extensions in PostMaster (sending in email) or uploading files (e.g. attaching files to mails) of ((OTRS)) Community Edition and OTRS allows an remote attacker to cause an endless loop. This issue affects: OTRS AG: ((OTRS)) Community Edition 5.0.x version 5.0.38 and prior versions; 6.0.x version 6.0.23 and prior versions. OTRS AG: OTRS 7.0.x version 7.0.12 and prior versions.
Weakness: CWE-835
Which versions are affected by CVE-2019-18180?
It affects 1 product.
Products include Otrs Otrs.
How do I fix CVE-2019-18180?
Upgrade to a fixed version.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2019-18180 being exploited?
There is no known exploitation of CVE-2019-18180 in the wild and no public exploit code.
Other vulnerabilities in Otrs Otrs
Sources
Also known as DEBIAN-CVE-2019-18180, GHSA-9g8p-x3jv-xwc5, UBUNTU-CVE-2019-18180.