Otrs vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-48209 An improper neutralization of user-controllable input in OTRS or ((OTRS)) Community Edition ticket handling allows authenticated attackers to perform reflected High 7.1 · Jun 1, 2026
• CVE-2026-48188 An improper Input Validation vulnerability in OTRS or ((OTRS)) Community Edition database layer module allows an unauthenticated SQL injection which can lead toCritical 9.1 · Jun 1, 2026
• CVE-2024-43444 Passwords of agents and customers are displayed in plain text in the OTRS admin log module if certain configurations regarding the authentication sources match High 8.2 · Aug 26, 2024
• CVE-2023-6254 A Vulnerability in OTRS AgentInterface and ExternalInterface allows the reading of plain text passwords which are send back to the client in the server responseHigh 8.1 · Nov 27, 2023
• CVE-2023-5422 The functions to fetch e-mail via POP3 or IMAP as well as sending e-mail via SMTP use OpenSSL for static SSL or TLS based communication.High 8.7 · Oct 16, 2023
• CVE-2023-38056 Improper Neutralization of commands allowed to be executed via OTRS System Configuration e.g.High 7.2 · Jul 24, 2023
• CVE-2023-2534 Improper Authorization vulnerability in OTRS AG OTRS 8 (Websocket API backend) allows any as Agent authenticated attacker to track user behaviour and to gain liHigh 7.6 · May 8, 2023
• CVE-2023-1250 Improper Input Validation vulnerability in OTRS AG OTRS (ACL modules), OTRS AG ((OTRS)) Community Edition (ACL modules) allows Local Execution of Code.High 7.4 · Mar 20, 2023
• CVE-2022-39052 An external attacker is able to send a specially crafted email (with many recipients) and trigger a potential DoS of the systemHigh 7.5 · Oct 17, 2022
• CVE-2013-4717 Multiple SQL injection vulnerabilities in Open Ticket Request System (OTRS) Help Desk 3.0.x before 3.0.22, 3.1.x before 3.1.18, and 3.2.x before 3.2.9 allow remHigh 8.8 · Aug 9, 2021
• CVE-2021-21441 There is a XSS vulnerability in the ticket overview screens.High 7.5 · Jun 16, 2021
• CVE-2020-1773 An attacker with the ability to generate session IDs or password reset tokens, either by being able to authenticate or by exploiting OSA-2020-09, may be able toHigh 7.3 · Mar 27, 2020
• CVE-2018-14593 An issue was discovered in Open Ticket Request System (OTRS) 6.0.x through 6.0.9, 5.0.x through 5.0.28, and 4.0.x through 4.0.30.High 8.8 · Aug 3, 2018
• CVE-2018-7567 In the Admin Package Manager in Open Ticket Request System (OTRS) 5.0.0 through 5.0.24 and 6.0.0 through 6.0.1, authenticated admins are able to exploit a BlindHigh 7.2 · Mar 4, 2018
• CVE-2017-17476 Open Ticket Request System (OTRS) 4.0.x before 4.0.28, 5.0.x before 5.0.26, and 6.0.x before 6.0.3, when cookie support is disabled, might allow remote attackerHigh 8.8 · Dec 20, 2017
• CVE-2017-16921 In OTRS 6.0.x up to and including 6.0.1, OTRS 5.0.x up to and including 5.0.24, and OTRS 4.0.x up to and including 4.0.26, an attacker who is logged into OTRS aHigh 8.8 · Dec 8, 2017
• CVE-2017-16664 Code injection exists in Kernel/System/Spelling.pm in Open Ticket Request System (OTRS) 5 before 5.0.24, 4 before 4.0.26, and 3.3 before 3.3.20.High 8.8 · Nov 21, 2017
• CVE-2017-15864 In the Agent Frontend in Open Ticket Request System (OTRS) 3.3.x through 3.3.18, with a crafted URL it is possible to gain information like database user and paHigh 8.8 · Nov 16, 2017
• CVE-2017-14635 In Open Ticket Request System (OTRS) 3.3.x before 3.3.18, 4.x before 4.0.25, and 5.x before 5.0.23, remote authenticated users can leverage statistics-write perHigh 8.8 · Sep 21, 2017
• CVE-2017-9324 In Open Ticket Request System (OTRS) 3.3.x through 3.3.16, 4.x through 4.0.23, and 5.x through 5.0.19, an attacker with agent permission is capable of opening aHigh 8.8 · Jun 12, 2017
• CVE-2016-5843 Multiple SQL injection vulnerabilities in the FAQ package 2.x before 2.3.6, 4.x before 4.0.5, and 5.x before 5.0.5 in Open Ticket Request System (OTRS) allow reCritical 9.4 · Sep 16, 2016
• CVE-2014-1471 SQL injection vulnerability in the StateGetStatesByType function in Kernel/System/State.pm in Open Ticket Request System (OTRS) 3.1.x before 3.1.19, 3.2.x beforHigh 7.5 · Feb 4, 2014
• CVE-2011-0456 webscript.pl in Open Ticket Request System (OTRS) 2.3.4 and earlier allows remote attackers to execute arbitrary commands via unspecified vectors, related to a High 7.5 · Mar 11, 2011
• CVE-2005-3893 Multiple SQL injection vulnerabilities in index.pl in Open Ticket Request System (OTRS) 1.0.0 through 1.3.2 and 2.0.0 through 2.0.3 allow remote attackers to exHigh 7.5 · Nov 29, 2005