Spoofing of From field in several screens

Vulnerability

An improper control of parameters in OTRS enables the spoofing of the From field in the AgentTicketCompose, AgentTicketForward, AgentTicketBounce, and AgentTicketEmailOutbound screens. This issue affects ((OTRS)) Community Edition 5.0.x up to version 5.0.39, 6.0.x up to version 6.0.24, and OTRS 7.0.x up to version 7.0.13 [1]. The vulnerability is present when an agent accesses these screens and the application fails to properly validate or sanitize the From field parameters.

Exploitation

An attacker must be an authenticated agent with network access to the OTRS web interface and the ability to interact with the affected screens (user interaction is required). The attacker can manipulate the parameters controlling the From field, for example by crafting a malicious request or modifying form data, to set an arbitrary email address as the sender. No special privileges beyond the standard agent role are needed, and the attack can be performed remotely over the network [1].

Impact

Successful exploitation allows the attacker to send emails from the OTRS system with a spoofed From address. This can be used for phishing, impersonation of other users or external parties, or to bypass email-based trust mechanisms. The impact is limited to integrity (low), as the attacker cannot read or modify other data, and no confidentiality or availability compromise occurs. The CVSS v3.1 score is 3.5 (LOW) [1].

Mitigation

The vulnerability is fixed in OTRS 7.0.14, ((OTRS)) Community Edition 6.0.25, and ((OTRS)) Community Edition 5.0.40, released on 2020-01-10 [1]. Patches are available via the official OTRS GitHub repository for Community Edition 6 and 5. No workarounds are documented, and the issue is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog. Users should upgrade to the patched versions immediately.