CVE-2019-13458

Vulnerability

An issue in Open Ticket Request System (OTRS) allows an authenticated agent with appropriate permissions to leverage OTRS notification tags in templates to disclose hashed user passwords. Affected versions include OTRS 7.0.x through 7.0.8, Community Edition 5.0.x through 5.0.36, and Community Edition 6.0.x through 6.0.19 [1].

Exploitation

An attacker must be logged into OTRS as an agent user with the necessary permissions. By crafting or modifying notification templates using OTRS notification tags, the attacker can extract hashed password values. The exact sequence of steps is not detailed in the available references, but the vulnerability is triggered through template manipulation [1].

Impact

Successful exploitation results in the disclosure of hashed user passwords. While the passwords are hashed, an attacker could attempt offline cracking to recover plaintext passwords, potentially leading to unauthorized access to other accounts or systems. The impact is primarily information disclosure of sensitive credential hashes [1].

Mitigation

For OTRS 7.0.x, upgrade to version 7.0.9 or later if available. For Community Edition 5.0.x and 6.0.x, note that 6.x is end-of-life and no longer receives security fixes; users should migrate to the current OTRS platform. The advisory [1] recommends upgrading to the latest supported version to address this vulnerability.