SECURITY ADVISORY

OTOBO 10.1.9 – Security Patch

PUBLISHED:
RELEASE TYPE:
CRITICALITY:
AFFECTED VERSIONS:
REFERENCE:

March 27, 2024
Security Patch Release
LOW
OTOBO 10.1
https://nvd.nist.gov/vuln/detail/CVE-2023-5421

Description

Problems

We fixed a vulnerability that allowed external content to be displayed in the ticket detail view without the user’s active consent. OTOBO is now much more stringent overall in its handling of HTML, which is displayed in articles, for example.

Many thanks to Tim Püttmanns (maxence) who brought this vulnerability to our attention.

POTENTIAL CONSEQUENCES

Display of external content without active consent

Damage Mitigation Measures

Update to OTOBO 10.1.9

A security patch update is available to fix the vulnerability. Please update your system system.

➞ Download Security Patch Package

Bugfixes

[Security Enhancement] Update to CKEditor Version 4.22.1
[Security Enhancement] Javascript tags are now filtered out of links
[Bugfix] Fixed a bug that caused incorrect ticket attributes to be used in ACLs after ticket creation in some cases
[Bugfix] Fixed an error that prevented standard values from being displayed correctly in dynamic fields on many masks
Translations into German, Norwegian, Arabic, and Spanish
and more (Changes)

We’re happy to answer your questions. Contact us.

You’re a support customer and need assistance with the security patch. Please contact us through your access in the support portal.

Downloads

Security Patch Update

Administrator Manual

Installation Guide

Developer Manual