| Package | Affected versions | Patched versions |
|---|---|---|
| otrs | ≥ 3.3.0, < 3.3.20≥ 4.0.0, < 4.0.26≥ 5.0.0, < 5.0.24 | 3.3.204.0.265.0.24 |
Code injection exists in Kernel/System/Spelling.pm in Open Ticket Request System (OTRS) 5 before 5.0.24, 4 before 4.0.26, and 3.3 before 3.3.20. In the agent interface, an authenticated remote attacker can execute shell commands as the webserver user via URL manipulation.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free