OTRS Community - Open Source - OTRS Help Desk - OTRS ITSM - Community News - Security Advisories

Security Advisory 2011-03

Vulnerabilities in the core of OTRS allows read access to any file on a local file system.

Vulnerability in OTRS iPhoneHandle interface allows user with valid session privilege escalation.

Several XSS attacks possible.

AgentTicketZoom is vulnerable to XSS attacks from HTML.

Multiple XSS and denial of service vulnerabilities.

Vulnerability in OTRS-Core allows SQL injection.

Vulnerability in OTRS SOAP interface allows remote access without valid SOAP user.

Vulnerability in OTRS agent mailbox view allows Cross-Site-Scripting.

Vulnerabilities in OTRS-Core allows SQL-Injection and Cross-Site-Scripting.