CVE-2024-6540

Publication date 15 July 2024

Last updated 26 August 2025

Ubuntu priority

Cvss 3 Severity Score

Description

Improper filtering of fields when using the export function in the ticket overview of the external interface in OTRS could allow an authorized user to download a list of tickets containing information about tickets of other customers. The problem only occurs if the TicketSearchLegacyEngine has been disabled by the administrator. This issue affects OTRS: 8.0.X, 2023.X, from 2024.X through 2024.4.x

Read the notes from the security team

Status

Show unmaintained releases

Package	Ubuntu Release	Status
znuny	24.04 LTS noble	Not affected
	22.04 LTS jammy	Not in release
	20.04 LTS focal	Not in release

Notes

0xnishit

Issue is listed as specific to >= 7.x, so won't affect Znuny which forked from 6.x

Severity score breakdown

Parameter	Value
Base score	5.3 · Medium
Attack vector	Network
Attack complexity	High
Privileges required	Low
User interaction	None
Scope	Unchanged
Confidentiality	High
Integrity impact	None
Availability impact	None
Vector	CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N