Information disclosure in support bundle files

Vulnerability

The vulnerability exists in the support bundle generation functionality of OTRS. Support bundles are ZIP archives containing logs and configuration files used for troubleshooting. The bug allows such bundles to inadvertently include sensitive information that was not intended to be disclosed. This affects ((OTRS)) Community Edition 5.0.41 and prior, 6.0.26 and prior, and OTRS 7.0.15 and prior [1].

Exploitation

An attacker must have high privileges (e.g., agent role with access to generate support bundles) and rely on user interaction (e.g., an administrator generating and sharing the bundle). The attacker does not need to be on the network; the attack vector is network-based. The specific steps involve generating a support bundle that includes the sensitive data and then accessing that bundle [1].

Impact

Successful exploitation leads to limited information disclosure (low confidentiality impact). The attacker gains access to sensitive data contained within the support bundle file. There is no impact on integrity or availability [1].

Mitigation

The issue is fixed in OTRS 7.0.16, ((OTRS)) Community Edition 6.0.27, and ((OTRS)) Community Edition 5.0.42. Patches are available via the GitHub commits referenced in the advisory. Organizations running affected versions should upgrade immediately. No workaround is documented [1].