No known CVE
Security Advisory

OTRSCE-SA-2024-01: OTRS Community Edition HTTP Response Splitting in Web Installer

Crafted URLs can inject malicious input into HTTP responses, leading to HTTP response splitting and XSS.

Overview

OTRS Community Edition is an open source help desk and IT service management system, maintained as a fork by Centuran Consulting. The web installation script copies part of the request URL into the HTTP response without stripping line breaks.

A crafted URL injects headers and body content into the response. That gives the attacker HTTP response splitting and cross-site scripting against anyone who opens the link. All versions through 6.0.40 are affected. Version 6.0.41, released 10 December 2024, fixes the issue.

Affected products

  • OTRS Community Edition 6.0.40 and earlier

Disclosure timeline

10 Dec 2024
Advisory OTRSCE-SA-2024-01 published; fix released in 6.0.41