CVE-2023-38056
No fix known EPSS <1%CVSS 7.2
Improper Neutralization of commands allowed to be executed via OTRS System Configuration e.g. SchedulerCronTaskModule using UnitTests modules allows any authenticated attacker with admin privileges local execution of Code.This issue affects OTRS: from 7.0.X before 7.0.45, from 8.0.X before 8.0.35; ((OTRS)) Community Edition: from 6.0.1 through 6.0.34.
Products: OTRS AG OTRS, OTRS AG ((OTRS)) Community Edition
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu 16.04 LTS | otrs2 | no fix |
| Ubuntu 18.04 LTS | otrs2 | no fix |
| Ubuntu 20.04 LTS | otrs2 | no fix |
| Ubuntu 22.04 LTS | otrs2 | no fix |
| Ubuntu 24.04 LTS | znuny | no fix |
| Ubuntu 25.10 | znuny | no fix |
| Ubuntu 26.04 LTS | znuny | no fix |
| Ubuntu 26.10 | znuny | no fix |