Description
Improper Check for filenames with overly long extensions in PostMaster (sending in email) or uploading files (e.g. attaching files to mails) of ((OTRS)) Community Edition and OTRS allows an remote attacker to cause an endless loop. This issue affects: OTRS AG: ((OTRS)) Community Edition 5.0.x version 5.0.38 and prior versions; 6.0.x version 6.0.23 and prior versions. OTRS AG: OTRS 7.0.x version 7.0.12 and prior versions.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| mitreCNA (assigner) | 3.1 | Medium5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L |
| NVDNVD · Modified | 3.1 | High7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
- EPSS (exploitation in 30 days)
- 2.6% · top 15% of all CVEs (6 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.3.
Weakness
Affected products
n/a
- affected n/a
What to do
Solution: Upgrade to OTRS 7.0.13 or OTRS 6.0.24 or OTRS 5.0.39
Solution: Patch for ((OTRS)) Community Edition 6.0: https://github.com/OTRS/otrs/commit/799616eb43f7fb53cae4e04c81e2156baaf02e2b Patch for ((OTRS)) Community Edition 5.0: https://github.com/OTRS/otrs/commit/76b301f4e3f45cb23bb6a3d6907028c733d11145
References (5)
- https://community.otrs.com/security-advisory-2019-15-security-update-for-otrs-framework/ (opens in a new tab)x_transferred
- openSUSE-SU-2020:0551 (opens in a new tab)vendor-advisoryx_transferred
- openSUSE-SU-2020:1475 (opens in a new tab)vendor-advisoryx_transferred
- openSUSE-SU-2020:1509 (opens in a new tab)vendor-advisoryx_transferred
- [debian-lts-announce] 20230831 [SECURITY] [DLA 3551-1] otrs2 security update (opens in a new tab)mailing-listx_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2019-18180)Record last updated .