p PatchFirst

CVE-2022-4427

CVE-2022-4427 · SQL Injection via OTRS Search API

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Improper Input Validation vulnerability in OTRS AG OTRS, OTRS AG ((OTRS)) Community Edition allows SQL Injection via TicketSearch Webservice This issue affects OTRS: from 7.0.1 before 7.0.40 Patch 1, from 8.0.1 before 8.0.28 Patch 1; ((OTRS)) Community Edition: from 6.0.1 through 6.0.34.

CVSS 6.5 · Medium · EPSS 0.8% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • otrs

    Versions
    • ≥ 7.0.1, < 7.0.40 Patch 1: Affected (Patch 1 (2022-12-19))
    • ≥ 8.0.1, < 8.0.28 Patch 1: Affected (Patch 1 (2022-12-19))

    Update to 7.0.40 Patch 1; Update to 8.0.28 Patch 1

  • ((otrs)) community edition

    Versions
    • ≥ 6.0.1, ≤ 6.0.34: Affected (All)

    No fix published

  • znuny Debian:12

    Versions
    • 6.3.2-3
    • 6.3.3-1
    • 6.3.3-1~bpo11+1
    • 6.3.4-1
    • 6.3.4-1~bpo11+1
    • 6.4.2-1
    • 6.4.2-1~bpo11+1
    • 6.4.2-2
    • 6.4.3-1
    • 6.4.3-1~bpo11+1
    • 6.4.4-1
    • 6.4.5-1~bpo11+1
    Affected ranges
    • ECOSYSTEM: < 6.4.5-1

    Update to 6.4.5-1

  • znuny Debian:13

    Versions
    • 6.3.2-3
    • 6.3.3-1
    • 6.3.3-1~bpo11+1
    • 6.3.4-1
    • 6.3.4-1~bpo11+1
    • 6.4.2-1
    • 6.4.2-1~bpo11+1
    • 6.4.2-2
    • 6.4.3-1
    • 6.4.3-1~bpo11+1
    • 6.4.4-1
    • 6.4.5-1~bpo11+1
    Affected ranges
    • ECOSYSTEM: < 6.4.5-1

    Update to 6.4.5-1

  • znuny Debian:14

    Versions
    • 6.3.2-3
    • 6.3.3-1
    • 6.3.3-1~bpo11+1
    • 6.3.4-1
    • 6.3.4-1~bpo11+1
    • 6.4.2-1
    • 6.4.2-1~bpo11+1
    • 6.4.2-2
    • 6.4.3-1
    • 6.4.3-1~bpo11+1
    • 6.4.4-1
    • 6.4.5-1~bpo11+1
    Affected ranges
    • ECOSYSTEM: < 6.4.5-1

    Update to 6.4.5-1

Original sources

Check your server →