CVE-2023-38060

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Improper Input Validation vulnerability in the ContentType parameter for attachments on TicketCreate or TicketUpdate operations of the OTRS Generic Interface modules allows any authenticated attacker to to perform an host header injection for the ContentType header of the attachment.

This issue affects OTRS: from 7.0.X before 7.0.45, from 8.0.X before 8.0.35; ((OTRS)) Community Edition: from 6.0.1 through 6.0.34.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-20 CWE-74

Affected software

No affected versions have been published.

Timeline

Published: Jul 24, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-380615.4In JetBrains TeamCity before 2023.05.1 stored XSS when using a custom theme was possible CVE-2023-380626.5In JetBrains TeamCity before 2023.05.1 parameters of the "password" type could be shown in the UI in certain composite build configurations CVE-2023-380635.4In JetBrains TeamCity before 2023.05.1 stored XSS while running custom builds was possible CVE-2023-380646.5In JetBrains TeamCity before 2023.05.1 build chain parameters of the "password" type could be written to the agent log CVE-2023-380655.4In JetBrains TeamCity before 2023.05.1 stored XSS while viewing the build log was possible CVE-2023-380666.1In JetBrains TeamCity before 2023.05.1 reflected XSS via the Referer header was possible during artifact downloads CVE-2023-380676.5In JetBrains TeamCity before 2023.05.1 build parameters of the "password" type could be written to the agent log CVE-2023-380687.3In JetBrains YouTrack before 2023.1.16597 captcha was not properly validated for Helpdesk forms CVE-2023-380693.3In JetBrains IntelliJ IDEA before 2023.1.4 license dialog could be suppressed in certain cases CVE-2023-38078.8A vulnerability has been found in Campcodes Beauty Salon Management System 1.0 and classified as critical. Affected by this vulnerability is CVE-2023-380707.8A vulnerability has been identified in JT2Go (All versions < V14.3.0.1), Teamcenter Visualization V13.3 (All versions < V13.3.0.12), Teamcen CVE-2023-380717.8A vulnerability has been identified in JT2Go (All versions < V14.3.0.1), Teamcenter Visualization V13.3 (All versions < V13.3.0.12), Teamcen