CVE-2023-5422
Severity CVSS v4.0:
Pending analysis
Type:
CWE-295
Improper Certificate Validation
Publication date:
16/10/2023
Last modified:
20/10/2023
Description
The functions to fetch e-mail via POP3 or IMAP as well as sending e-mail via SMTP use OpenSSL for static SSL or TLS based communication. As the <br />
SSL_get_verify_result() function is not used the certificated is trusted always and it can not be ensured that the certificate <br />
satisfies all necessary security requirements.<br />
<br />
This could allow an <br />
attacker to use an invalid certificate to claim to be a trusted host, <br />
use expired certificates, or conduct other attacks that could be <br />
detected if the certificate is properly validated.<br />
<br />
This issue affects OTRS: from 7.0.X before 7.0.47, from 8.0.X before 8.0.37; ((OTRS)) Community Edition: from 6.0.X through 6.0.34.<br />
<br />
Impact
Base Score 3.x
9.10
Severity 3.x
CRITICAL
Vulnerable products and versions
| CPE | From | Up to |
|---|---|---|
| cpe:2.3:a:otrs:otrs:*:*:*:*:community:*:*:* | 6.0.0 (including) | 6.0.34 (including) |
| cpe:2.3:a:otrs:otrs:*:*:*:*:*:*:*:* | 7.0.0 (including) | 7.0.47 (excluding) |
| cpe:2.3:a:otrs:otrs:*:*:*:*:*:*:*:* | 8.0.0 (including) | 8.0.37 (excluding) |
To consult the complete list of CPE names with products and versions, see this page