CVE-2023-38056

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

Improper Neutralization of commands allowed to be executed via OTRS System Configuration e.g. SchedulerCronTaskModule using UnitTests modules allows any authenticated attacker with admin privileges local execution of Code.This issue affects OTRS: from 7.0.X before 7.0.45, from 8.0.X before 8.0.35; ((OTRS)) Community Edition: from 6.0.1 through 6.0.34.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

No affected versions have been published.

Timeline

Published: Jul 24, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-380575.4An improper input validation vulnerability in OTRS Survey modules allows any attacker with a link to a valid and unanswered survey request t CVE-2023-380584.3An improper privilege check in the OTRS ticket move action in the agent interface allows any as agent authenticated attacker to to perfor CVE-2023-380595.3The loading of external images is not blocked, even if configured, if the attacker uses protocol-relative URL in the payload. This can be us CVE-2023-38069.8A vulnerability, which was classified as critical, was found in SourceCodester House Rental and Property Listing System 1.0. Affected is an CVE-2023-380608.8Improper Input Validation vulnerability in the ContentType parameter for attachments on TicketCreate or TicketUpdate operations of the OTRS CVE-2023-380615.4In JetBrains TeamCity before 2023.05.1 stored XSS when using a custom theme was possible CVE-2023-380626.5In JetBrains TeamCity before 2023.05.1 parameters of the "password" type could be shown in the UI in certain composite build configurations CVE-2023-380635.4In JetBrains TeamCity before 2023.05.1 stored XSS while running custom builds was possible CVE-2023-380646.5In JetBrains TeamCity before 2023.05.1 build chain parameters of the "password" type could be written to the agent log CVE-2023-380655.4In JetBrains TeamCity before 2023.05.1 stored XSS while viewing the build log was possible CVE-2023-380666.1In JetBrains TeamCity before 2023.05.1 reflected XSS via the Referer header was possible during artifact downloads CVE-2023-380676.5In JetBrains TeamCity before 2023.05.1 build parameters of the "password" type could be written to the agent log