CVE-2024-23790
CVE-2024-23790 · Missing file type check in avatar picture upload
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Improper Input Validation vulnerability in the upload functionality for user avatars allows functionality misuse due to missing check of filetypes. This issue affects OTRS: from 7.0.X through 7.0.48, from 8.0.X through 8.0.37, from 2023 through 2023.1.1.
CVSS 3.5 · Low · EPSS 0.3%
- Published
- Updated
Stack: system
Affected products and versions
otrs
- Versions
- ≥ 8.0.x, ≤ 8.0.37: Affected (Patch)
- ≥ 2023, ≤ 2023.1.1: Affected (Patch)
- ≥ 7.0.x, ≤ 7.0.48: Affected (Patch)
No fix published
otrs2 Ubuntu:16.04:LTS
- Versions
- 4.0.10-1
- 5.0.1-1
- 5.0.1-2
- 5.0.2-1
- 5.0.3-1
- 5.0.5-1
- 5.0.6-1
- 5.0.7-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
otrs2 Ubuntu:18.04:LTS
- Versions
- 5.0.23-1
- 5.0.24-1
- 6.0.1-1
- 6.0.2-1
- 6.0.3-1
- 6.0.4-1
- 6.0.5-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
otrs2 Ubuntu:20.04:LTS
- Versions
- 6.0.20-1
- 6.0.23-2
- 6.0.24-1
- 6.0.25-1
- 6.0.25-2
- 6.0.25-3
- 6.0.26-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
otrs2 Ubuntu:22.04:LTS
- Versions
- 6.0.32-6
- 6.1.2-1
- 6.2.1-1
- 6.2.2-2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
znuny Ubuntu:24.04:LTS
- Versions
- 6.5.3-1
- 6.5.4-1
- 6.5.5-1
- 6.5.6-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
znuny Ubuntu:25.10
- Versions
- 6.5.14-1
- 6.5.15-2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
znuny Ubuntu:26.10
- Versions
- 6.5.18-1
- 6.5.20-1
- 6.5.21-1
- 6.5.22-1
- 6.5.23-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
znuny Ubuntu:26.04:LTS
- Versions
- 6.5.15-2
- 6.5.18-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published