CVE-2024-23791 (GCVE-0-2024-23791)

Vulnerability from cvelistv5 – Published: 2024-01-29 09:21 – Updated: 2025-05-29 15:10
VLAI?
Title
Unnecessary data is written to log if issues during indexing occurs
Summary
Insertion of debug information into log file during building the elastic search index allows reading of sensitive information from articles.This issue affects OTRS: from 7.0.X through 7.0.48, from 8.0.X through 8.0.37, from 2023.X through 2023.1.1.
Severity ?
4.9 (Medium)
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
CWE
  • CWE-532 - Insertion of Sensitive Information into Log File
Assigner
References
Impacted products
Vendor Product Version
OTRS AG OTRS Affected: 7.0.x , ≤ 7.0.48 (Patch)
Affected: 8.0.x , ≤ 8.0.37 (Patch)
Affected: 2023.x , ≤ 2023.1.1 (Patch)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-01T23:13:07.364Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://otrs.com/release-notes/otrs-security-advisory-2024-02/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-23791",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-05-08T15:50:47.563428Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-05-29T15:10:14.868Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "modules": [
            "Log Backend"
          ],
          "product": "OTRS",
          "vendor": "OTRS AG",
          "versions": [
            {
              "lessThanOrEqual": "7.0.48",
              "status": "affected",
              "version": "7.0.x",
              "versionType": "Patch"
            },
            {
              "lessThanOrEqual": "8.0.37",
              "status": "affected",
              "version": "8.0.x",
              "versionType": "Patch"
            },
            {
              "lessThanOrEqual": "2023.1.1",
              "status": "affected",
              "version": "2023.x",
              "versionType": "Patch"
            }
          ]
        }
      ],
      "datePublic": "2024-01-29T08:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Insertion of debug information into log file during building the elastic search index allows reading of sensitive information from articles.\u003cp\u003eThis issue affects OTRS: from 7.0.X through 7.0.48, from 8.0.X through 8.0.37, from 2023.X through 2023.1.1.\u003c/p\u003e"
            }
          ],
          "value": "Insertion of debug information into log file during building the elastic search index allows reading of sensitive information from articles.This issue affects OTRS: from 7.0.X through 7.0.48, from 8.0.X through 8.0.37, from 2023.X through 2023.1.1.\n\n"
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-545",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-545 Pull Data from System Resources"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-532",
              "description": "CWE-532 Insertion of Sensitive Information into Log File",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-01-29T09:21:00.278Z",
        "orgId": "2e1bf29f-dc29-4ed8-830c-7b9348b6f0e8",
        "shortName": "OTRS"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://otrs.com/release-notes/otrs-security-advisory-2024-02/"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cdiv\u003eUpdate to OTRS Patch 2024.1.1\u003c/div\u003e\u003cdiv\u003eUpdate to OTRS 7.0.49 (Long Term Support Users)\u003c/div\u003e\u003cbr\u003e"
            }
          ],
          "value": "Update to OTRS Patch 2024.1.1\n\nUpdate to OTRS 7.0.49 (Long Term Support Users)\n\n"
        }
      ],
      "source": {
        "advisory": "OSA-2024-02",
        "defect": [
          "Issue#1224",
          "Ticket#2021091742001128"
        ],
        "discovery": "USER"
      },
      "title": "Unnecessary data is written to log if issues during indexing occurs",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2e1bf29f-dc29-4ed8-830c-7b9348b6f0e8",
    "assignerShortName": "OTRS",
    "cveId": "CVE-2024-23791",
    "datePublished": "2024-01-29T09:21:00.278Z",
    "dateReserved": "2024-01-22T10:32:00.704Z",
    "dateUpdated": "2025-05-29T15:10:14.868Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:otrs:otrs:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"7.0.0\", \"versionEndExcluding\": \"7.0.49\", \"matchCriteriaId\": \"4E47E75A-C9A9-40EE-A5DE-B4CDD98E7B7F\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:otrs:otrs:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"8.0.0\", \"versionEndExcluding\": \"2024.1.1\", \"matchCriteriaId\": \"3B9B2075-4C3E-48C9-96DA-655E4F29325A\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"Insertion of debug information into log file during building the elastic search index allows reading of sensitive information from articles.This issue affects OTRS: from 7.0.X through 7.0.48, from 8.0.X through 8.0.37, from 2023.X through 2023.1.1.\\n\\n\"}, {\"lang\": \"es\", \"value\": \"La inserci\\u00f3n de informaci\\u00f3n de depuraci\\u00f3n en el archivo de registro durante la creaci\\u00f3n del \\u00edndice de b\\u00fasqueda el\\u00e1stico permite leer informaci\\u00f3n confidencial de los art\\u00edculos. Este problema afecta a OTRS: de 7.0.X a 7.0.48, de 8.0.X a 8.0.37, de 2023.X a 2023.1 .1.\"}]",
      "id": "CVE-2024-23791",
      "lastModified": "2024-11-21T08:58:25.570",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"security@otrs.com\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N\", \"baseScore\": 4.9, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"HIGH\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 1.2, \"impactScore\": 3.6}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\", \"baseScore\": 7.5, \"baseSeverity\": \"HIGH\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 3.9, \"impactScore\": 3.6}]}",
      "published": "2024-01-29T10:15:08.483",
      "references": "[{\"url\": \"https://otrs.com/release-notes/otrs-security-advisory-2024-02/\", \"source\": \"security@otrs.com\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"https://otrs.com/release-notes/otrs-security-advisory-2024-02/\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Vendor Advisory\"]}]",
      "sourceIdentifier": "security@otrs.com",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"security@otrs.com\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-532\"}]}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-532\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-23791\",\"sourceIdentifier\":\"security@otrs.com\",\"published\":\"2024-01-29T10:15:08.483\",\"lastModified\":\"2024-11-21T08:58:25.570\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Insertion of debug information into log file during building the elastic search index allows reading of sensitive information from articles.This issue affects OTRS: from 7.0.X through 7.0.48, from 8.0.X through 8.0.37, from 2023.X through 2023.1.1.\\n\\n\"},{\"lang\":\"es\",\"value\":\"La inserci\u00f3n de informaci\u00f3n de depuraci\u00f3n en el archivo de registro durante la creaci\u00f3n del \u00edndice de b\u00fasqueda el\u00e1stico permite leer informaci\u00f3n confidencial de los art\u00edculos. Este problema afecta a OTRS: de 7.0.X a 7.0.48, de 8.0.X a 8.0.37, de 2023.X a 2023.1 .1.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security@otrs.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N\",\"baseScore\":4.9,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"HIGH\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":1.2,\"impactScore\":3.6},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"security@otrs.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-532\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-532\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:otrs:otrs:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"7.0.0\",\"versionEndExcluding\":\"7.0.49\",\"matchCriteriaId\":\"4E47E75A-C9A9-40EE-A5DE-B4CDD98E7B7F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:otrs:otrs:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"8.0.0\",\"versionEndExcluding\":\"2024.1.1\",\"matchCriteriaId\":\"3B9B2075-4C3E-48C9-96DA-655E4F29325A\"}]}]}],\"references\":[{\"url\":\"https://otrs.com/release-notes/otrs-security-advisory-2024-02/\",\"source\":\"security@otrs.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://otrs.com/release-notes/otrs-security-advisory-2024-02/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://otrs.com/release-notes/otrs-security-advisory-2024-02/\", \"tags\": [\"vendor-advisory\", \"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-01T23:13:07.364Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-23791\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-05-08T15:50:47.563428Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-05-08T15:50:49.434Z\"}}], \"cna\": {\"title\": \"Unnecessary data is written to log if issues during indexing occurs\", \"source\": {\"defect\": [\"Issue#1224\", \"Ticket#2021091742001128\"], \"advisory\": \"OSA-2024-02\", \"discovery\": \"USER\"}, \"impacts\": [{\"capecId\": \"CAPEC-545\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-545 Pull Data from System Resources\"}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 4.9, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"HIGH\", \"confidentialityImpact\": \"HIGH\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"OTRS AG\", \"modules\": [\"Log Backend\"], \"product\": \"OTRS\", \"versions\": [{\"status\": \"affected\", \"version\": \"7.0.x\", \"versionType\": \"Patch\", \"lessThanOrEqual\": \"7.0.48\"}, {\"status\": \"affected\", \"version\": \"8.0.x\", \"versionType\": \"Patch\", \"lessThanOrEqual\": \"8.0.37\"}, {\"status\": \"affected\", \"version\": \"2023.x\", \"versionType\": \"Patch\", \"lessThanOrEqual\": \"2023.1.1\"}], \"defaultStatus\": \"unknown\"}], \"solutions\": [{\"lang\": \"en\", \"value\": \"Update to OTRS Patch 2024.1.1\\n\\nUpdate to OTRS 7.0.49 (Long Term Support Users)\\n\\n\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cdiv\u003eUpdate to OTRS Patch 2024.1.1\u003c/div\u003e\u003cdiv\u003eUpdate to OTRS 7.0.49 (Long Term Support Users)\u003c/div\u003e\u003cbr\u003e\", \"base64\": false}]}], \"datePublic\": \"2024-01-29T08:00:00.000Z\", \"references\": [{\"url\": \"https://otrs.com/release-notes/otrs-security-advisory-2024-02/\", \"tags\": [\"vendor-advisory\"]}], \"x_generator\": {\"engine\": \"Vulnogram 0.1.0-dev\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"Insertion of debug information into log file during building the elastic search index allows reading of sensitive information from articles.This issue affects OTRS: from 7.0.X through 7.0.48, from 8.0.X through 8.0.37, from 2023.X through 2023.1.1.\\n\\n\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"Insertion of debug information into log file during building the elastic search index allows reading of sensitive information from articles.\u003cp\u003eThis issue affects OTRS: from 7.0.X through 7.0.48, from 8.0.X through 8.0.37, from 2023.X through 2023.1.1.\u003c/p\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-532\", \"description\": \"CWE-532 Insertion of Sensitive Information into Log File\"}]}], \"providerMetadata\": {\"orgId\": \"2e1bf29f-dc29-4ed8-830c-7b9348b6f0e8\", \"shortName\": \"OTRS\", \"dateUpdated\": \"2024-01-29T09:21:00.278Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-23791\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-05-29T15:10:14.868Z\", \"dateReserved\": \"2024-01-22T10:32:00.704Z\", \"assignerOrgId\": \"2e1bf29f-dc29-4ed8-830c-7b9348b6f0e8\", \"datePublished\": \"2024-01-29T09:21:00.278Z\", \"assignerShortName\": \"OTRS\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.