PT-2022-13199
CVE-2022-0474
·
تاريخ النشر
2022-02-07
·
تاريخ التحديث
2022-02-25
الوصف من
CVSS 2.0
3.5
منخفضةالمقاييسAV:N/AC:M/Au:S/C:P/I:N/A:N
Name of the Vulnerable Software and Affected Versions
OTRSCustomContactFields versions 8.0.11 and prior versions.
Description
The issue allows the full list of recipients from customer users in a contact field to be disclosed in notification emails, even when the notification is set to be sent to each recipient individually.
Recommendations
For versions 8.0.11 and prior, consider disabling the notification feature that sends emails to each recipient individually until a fix is available. Restrict access to the contact field to minimize the risk of recipient disclosure.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾