| Package | Affected versions | Patched versions |
|---|---|---|
| custom contact fields | ≥ 8.0.0, < 8.0.12 | 8.0.12 |
Full list of recipients from customer users in a contact field could be disclosed in notification emails event when the notification is set to be sent to each recipient individually. This issue affects: OTRS AG OTRSCustomContactFields 8.0.x version: 8.0.11 and prior versions.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free