Autocomplete in the form login screens

Vulnerability

The login screens for both agent and customer interfaces in ((OTRS)) Community Edition 5.0.41 and prior versions, 6.0.26 and prior versions, and OTRS 7.0.15 and prior versions have the autocomplete attribute enabled on the Username and Password fields [1]. This allows browsers to store entered credentials, which can be retrieved by an attacker with local access to the user's computer or via cross-site scripting in other contexts.

Exploitation

An attacker would need to have physical or remote access to the victim's browser storage or the ability to execute JavaScript in the same browser context (e.g., through a separate XSS). No authentication is needed to reach the login screen; the attack relies on the user's browser having previously saved credentials through autocomplete. The attacker can then extract the stored values from the browser's password manager.

Impact

If successful, the attacker gains the username and password for the OTRS system (agent or customer interface). This represents a low-level confidentiality impact (C:L), as only credential disclosure is possible; the attacker must separately gain access to the browser environment [1].

Mitigation

Upgrade to the fixed versions: OTRS 7.0.16, ((OTRS)) Community Edition 6.0.27, or ((OTRS)) Community Edition 5.0.42 [1]. Patches are available via the referenced commits [1]. No workaround is documented; disabling autocomplete in the login form is the recommended fix.