Vulnerability Intelligence Report
Passwords are written to Admin Log Module
CVE-2024-43444
Passwords of agents and customers are displayed in plain text in the OTRS admin log module if certain configurations regarding the authentication sources match and debugging for the authentication backend has been enabled. This issue affects: * OTRS from 7.0.X through 7.0.50 * OTRS 8.0.X * OTRS 2023.X * OTRS from 2024.X through 2024.5.X * ((OTRS)) Community Edition: 6.0.x Products based on the ((OTRS)) Community Edition also very likely to be affected
No Active Exploit Signals
CVSS Base Score
8.2
HIGH
Exploitability:3.9
Impact Score:4.3
EPSS Probability:0.38%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Weaknesses (CWE)
CWE-532 ↗CWE-532 Insertion of Sensitive Information into Log File
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| OTRS AG | OTRS | 7.0.x <= 7.0.50 (affected), 8.0.x (affected), 2023.x (affected), 2024.x <= 2024.5.x (affected) |
| OTRS AG | ((OTRS)) Community Edition | 6.0.x (affected) |
References & Technical Advisories
No reference links found.
Threat Intelligence Signals
EPSS Score
0.376%
GitHub Advisory
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | OTRS AG · Vendor · Germany |
| Reserved | 2024-08-13T13:38:47 |
| Published | 2024-08-26T08:42:58 |
| Patch Date | 2024-08-26 |
| Last Updated | 2024-08-29T07:36:13 |
Community Chatter & Buzz