CVE-2024-23790

CRITICAL 9.8CVE-2024-23790 · Published 29/01/2024 · updated 17/06/2026

In short

CVE-2024-23790 is a CRITICAL (CVSS 9.8) vulnerability affecting otrs (otrs).
Chance of exploitation in the next 30 days (EPSS): 0.25%, higher than 16.9% of all vulnerabilities.
Fix: update to 7.0.49, 2024.1.1 or later.

Package	Affected versions	Patched versions
otrs otrs	`≥ 7.0.0, < 7.0.49≥ 8.0.0, < 2024.1.1`	`7.0.492024.1.1`

Description

Improper Input Validation vulnerability in the upload functionality for user avatars allows functionality misuse due to missing check of filetypes. This issue affects OTRS: from 7.0.X through 7.0.48, from 8.0.X through 8.0.37, from 2023 through 2023.1.1.

References

otrs.com/release-notes/otrs-security-advisory-2024-01 · Vendor Advisory

More vulnerabilities in otrs

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

otrs

≥ 7.0.0, < 7.0.49≥ 8.0.0, < 2024.1.1

7.0.492024.1.1

More vulnerabilities in otrs

See all →