David Silva

Name of the Vulnerable Software and Affected Versions: OTRS versions 7.0.X OTRS versions 8.0.X OTRS versions 2023.X OTRS versions 2024.X OTRS versions 2025.X Description: A flaw in the External Interface of OTRS allows attackers to determine the existence of user accounts by analyzing different HTTP response codes and messages. This enables systematic identification of valid email addresses. Recommendations: OTRS versions 7.0.X: At the moment, there is no information about a newer version that contains a fix for this vulnerability. OTRS versions 8.0.X: At the moment, there is no information about a newer version that contains a fix for this vulnerability. OTRS versions 2023.X: At the moment, there is no information about a newer version that contains a fix for this vulnerability. OTRS versions 2024.X: At the moment, there is no information about a newer version that contains a fix for this vulnerability. OTRS versions 2025.X: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

A critical issue has been found in the Plugin Editor Page component, specifically affecting some unknown functionality of the file /admin-cp/plugin/editor. This issue leads to improper access controls, allowing for remote attacks. The exploit has been publicly disclosed.

The issue arises when the server is misconfigured, specifically with an incorrect installation process and disregard of Health Check results. In such cases, the Passbolt API can send email messages with a domain name taken from an attacker-controlled HTTP Host header.

The issue allows a remote attacker to execute arbitrary code via a crafted script to the file upload function in the created forms component. This enables the attacker to potentially gain control over the system.

The issue in BoltWire allows a remote attacker to obtain sensitive information via a crafted payload to the view and change admin password function. This is related to insufficient protection of service data, which can be exploited by a remote attacker to gain access to confidential data.

A cross-site scripting (XSS) issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the `name` and `lastname` parameters.