CVE-2025-24387
CVE-2025-24387
Título es
CVE-2025-24387
Lun, 10/03/2025 – 10:15
Tipo
CWE-1275
Gravedad 2.0 Txt
Pendiente de análisis
Título en
CVE-2025-24387
Descripción en
A vulnerability in OTRS Application Server allows session hijacking due to missing attributes for sensitive
cookie settings in HTTPS sessions. A request to an OTRS endpoint from a possible malicious web site, would send the authentication cookie, performing an unwanted read operation.
This issue affects:
* OTRS 7.0.X
* OTRS 8.0.X
* OTRS 2023.X
* OTRS 2024.X
* OTRS 2025.x
10/03/2025
10/03/2025
Vector CVSS:3.1
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N
Gravedad 3.1 (CVSS 3.1 Base Score)
4.80
Gravedad 3.1 Txt Gravedad 3.1 (CVSS 3.1 Base Score)
MEDIUM
Referencias
https://otrs.com/release-notes/otrs-security-advisory-2025-05/
Enviar en el boletín
Off
