SB2011031816 - Input validation error in OTRS

Description

This security bulletin contains information about 1 vulnerability.

1) Input validation error (CVE-ID: CVE-2010-4766)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

The AgentTicketForward feature in Open Ticket Request System (OTRS) before 2.4.7 does not properly remove inline images from HTML e-mail messages, which allows remote attackers to obtain potentially sensitive image information in opportunistic circumstances by reading a forwarded message in a standard e-mail client.

Remediation

Install update from vendor's website.

References

• http://bugs.otrs.org/show_bug.cgi?id=4818
• http://source.otrs.org/viewvc.cgi/otrs/CHANGES?revision=1.1807