CVE-2019-12248

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

An issue was discovered in Open Ticket Request System (OTRS) 7.0.x through 7.0.7, Community Edition 6.0.x through 6.0.19, and Community Edition 5.0.x through 5.0.36. An attacker could send a malicious email to an OTRS system. If a logged-in agent user quotes it, the email could cause the browser to load external image resources.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00038.htmlBroken Link
http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00066.htmlBroken Link
http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00077.htmlBroken Link
https://lists.debian.org/debian-lts-announce/2019/06/msg00004.htmlMailing List, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2023/08/msg00040.html
https://www.otrs.com/category/release-and-security-notes-en/Release Notes, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00038.htmlBroken Link
http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00066.htmlBroken Link
http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00077.htmlBroken Link
https://lists.debian.org/debian-lts-announce/2019/06/msg00004.htmlMailing List, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2023/08/msg00040.html
https://www.otrs.com/category/release-and-security-notes-en/Release Notes, Third Party Advisory

Timeline

Published: Jun 17, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-12257.5An information disclosure vulnerability exists when the Windows RDP server improperly discloses the contents of its memory. An attacker who CVE-2019-122506.1IdentityServer IdentityServer4 through 2.4 has stored XSS via the httpContext to the host/Extensions/RequestLoggerMiddleware.cs LogForErrorC CVE-2019-122518.8sadmin/ceditpost.php in UCMS 1.4.7 allows SQL Injection via the index.php?do=sadmin_ceditpost cvalue parameter.CVE-2019-122526.5In Zoho ManageEngine ServiceDesk Plus through 10.5, users with the lowest privileges (guest) can view an arbitrary post by appending its num CVE-2019-122536.5my little forum before 2.4.20 allows CSRF to delete posts, as demonstrated by mode=posting&delete_posting.CVE-2019-122549.8In multiple Tecson Tankspion and GOKs SmartBox 4 products the affected application doesn't properly restrict access to an endpoint that is r CVE-2019-122559.8Wind River VxWorks has a Buffer Overflow in the TCP component (issue 1 of 4). This is a IPNET security vulnerability: TCP Urgent Pointer = 0 CVE-2019-122569.8Wind River VxWorks 6.9 and vx7 has a Buffer Overflow in the IPv4 component. There is an IPNET security vulnerability: Stack overflow in the CVE-2019-122578.8Wind River VxWorks 6.6 through 6.9 has a Buffer Overflow in the DHCP client component. There is an IPNET security vulnerability: Heap overfl CVE-2019-122587.5Wind River VxWorks 6.6 through vx7 has Session Fixation in the TCP component. This is a IPNET security vulnerability: DoS of TCP connection CVE-2019-122597.5Wind River VxWorks 6.6, 6.7, 6.8, 6.9 and vx7 has an array index error in the IGMPv3 client component. There is an IPNET security vulnerabil CVE-2019-12269.8A remote code execution vulnerability exists in Remote Desktop Services – formerly known as Terminal Services – when an unauthenticated atta