CVE-2025-24389 SMTP Password will be shown in cleartext on some SMTP errors
Attackers can view SMTP passwords in cleartext via system logs or admin emails triggered by specific upstream library errors.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-24389?
CVE-2025-24389 is a medium-severity vulnerability in ((OTRS)) Community Edition, published on 27 Jan 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Certain errors of the upstream libraries will insert sensitive information in the OTRS or ((OTRS)) Community Edition log mechanism and mails send to the system administrator.
This issue affects:
* OTRS 7.0.X
* OTRS 8.0.X * OTRS 2023.X * OTRS 2024.X
* ((OTRS)) Community Edition: 6.0.x
Products based on the ((OTRS)) Community Edition also very likely to be affected
Weakness: CWE-532
Which versions are affected by CVE-2025-24389?
How do I fix CVE-2025-24389?
No fix has been published for CVE-2025-24389 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-24389 being exploited?
There is no known exploitation of CVE-2025-24389 in the wild and no public exploit code.
Sources
Also known as GHSA-mvq2-cppv-f4gq.