CVE-2023-38059 External pictures can be loaded even if not allowed by configuration
Attackers can bypass image loading restrictions using protocol-relative URLs to disclose user IP addresses in OTRS ticketing systems.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-38059?
CVE-2023-38059 is a medium-severity vulnerability in Otrs Otrs, published on 16 Oct 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The loading of external images is not blocked, even if configured, if the attacker uses protocol-relative URL in the payload. This can be used to retreive the IP of the user.This issue affects OTRS: from 7.0.X before 7.0.47, from 8.0.X before 8.0.37; ((OTRS)) Community Edition: from 6.0.X through 6.0.34.
Weakness: CWE-200
Which versions are affected by CVE-2023-38059?
It affects 1 product.
Products include Otrs Otrs.
How do I fix CVE-2023-38059?
No fix has been published for CVE-2023-38059 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-38059 being exploited?
There is no known exploitation of CVE-2023-38059 in the wild and no public exploit code.
Other vulnerabilities in Otrs Otrs
Sources
Also known as GHSA-6gr4-x7gv-xwjp, UBUNTU-CVE-2023-38059.