CVE-2024-43445 Missing X-Content-Type-Options: nosniff Header Allows MIME Type Sniffing
Attackers can exploit missing security headers to force MIME type sniffing, potentially bypassing content restrictions in OTRS.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2024-43445?
CVE-2024-43445 is a medium-severity vulnerability in ((OTRS)) Community Edition, published on 27 Jan 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A vulnerability exists in OTRS and ((OTRS Community Edition)) that fail to set the HTTP response header X-Content-Type-Options to nosniff. An attacker could exploit this vulnerability by uploading or inserting content that would be treated as a different MIME type than intended.
This issue affects:
* OTRS 7.0.X
* OTRS 8.0.X * OTRS 2023.X * OTRS 2024.X
* ((OTRS)) Community Edition: 6.0.x
Products based on the ((OTRS)) Community Edition also very likely to be affected
Weakness: CWE-20
Which versions are affected by CVE-2024-43445?
How do I fix CVE-2024-43445?
No fix has been published for CVE-2024-43445 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-43445 being exploited?
There is no known exploitation of CVE-2024-43445 in the wild and no public exploit code.
Sources
Also known as GHSA-fg8c-fxj5-qp3x.