CVE-2025-24391 | THREATINT

We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.

Please see our statement on Data Privacy.

Crisp.chat (Helpdesk and Chat)

Ok

Description

A vulnerability in the External Interface of OTRS allows conclusions to be drawn about the existence of user accounts through different HTTP response codes and messages. This enables an attacker to systematically identify valid email addresses. This issue affects: * OTRS 7.0.X * OTRS 8.0.X * OTRS 2023.X * OTRS 2024.X * OTRS 2025.X

Reserved 2025-01-21 | Published 2025-07-14 | Updated 2025-07-14 | Assigner OTRS

MEDIUM: 5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Problem types

CWE-203 Observable Discrepancy

Product status

Default status

affected

7.0.x

affected

8.0.x

affected

2023.x

affected

2024.x

affected

2025.x

affected

Credits

Special thanks to David Silva for reporting this vulnerability. reporter

References

otrs.com/release-notes/otrs-security-advisory-2025-07/

cve.org (CVE-2025-24391)

nvd.nist.gov (CVE-2025-24391)

Download JSON

https://cve.threatint.eu/CVE/CVE-2025-24391

Support options

Helpdesk Chat, Email, Knowledgebase