CVE-2023-2534 Information disclouse and DoS via websocket push events

High 7.6 Published 8 May 2023 Updated 29 Jan 2025

Authenticated agents can track user behavior and cause server performance issues due to improper authorization in the websocket API.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2023-2534?

CVE-2023-2534 is a high-severity missing authorization vulnerability in Otrs Otrs, published on 8 May 2023. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Improper Authorization vulnerability in OTRS AG OTRS 8 (Websocket API backend) allows any as Agent authenticated attacker to track user behaviour and to gain live insight into overall system usage. User IDs can easily be correlated with real names e. g. via ticket histories by any user. (Fuzzing for garnering other adjacent user/sensitive data). Subscribing to all possible push events could also lead to performance implications on the server side, depending on the size of the installation and the number of active users. (Flooding)This issue affects OTRS: from 8.0.X before 8.0.32.

Weakness: CWE-863, CWE-285

Which versions are affected by CVE-2023-2534?

It affects 1 product.

Products include Otrs Otrs.

How do I fix CVE-2023-2534?

No fix has been published for CVE-2023-2534 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2023-2534 being exploited?

There is no known exploitation of CVE-2023-2534 in the wild and no public exploit code.

All Otrs Otrs vulnerabilities

Sources

Also known as GHSA-67qg-pjv2-pg9v.