CVE-2024-43444

HighCVSS 8.2/10Last modified Jun 17, 2026

Description

Passwords of agents and customers are displayed in plain text in the OTRS admin log module if certain configurations regarding the authentication sources match and debugging for the authentication backend has been enabled.

This issue affects:

* OTRS from 7.0.X through 7.0.50 * OTRS 8.0.X * OTRS 2023.X * OTRS from 2024.X through 2024.5.X * ((OTRS)) Community Edition: 6.0.x

Products based on the ((OTRS)) Community Edition also very likely to be affected

Metrics

CVSS 3.1 8.2/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Weakness enumeration

CWE-532

Affected software

No affected versions have been published.

Timeline

Published
Aug 26, 2024
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2024

CVE-2024-434455.4A vulnerability exists in OTRS and ((OTRS Community Edition)) that fail to set the HTTP response header X-Content-Type-Options to nosniff. ACVE-2024-434463.5An improper privilege management vulnerability in OTRS Generic Interface module allows change of the Ticket status even if the user only hasCVE-2024-434478.1Windows SMBv3 Server Remote Code Execution VulnerabilityCVE-2024-434496.8Windows USB Video Class System Driver Elevation of Privilege VulnerabilityCVE-2024-43459.8The Startklar Elementor Addons plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the CVE-2024-434507.5Windows DNS Spoofing VulnerabilityCVE-2024-434516.5NTLM Hash Disclosure Spoofing VulnerabilityCVE-2024-434527.5Windows Registry Elevation of Privilege VulnerabilityCVE-2024-434538.8Windows Routing and Remote Access Service (RRAS) Remote Code Execution VulnerabilityCVE-2024-434547.1Windows Remote Desktop Licensing Service Remote Code Execution VulnerabilityCVE-2024-434559.8Windows Remote Desktop Licensing Service Spoofing VulnerabilityCVE-2024-434567.4Windows Remote Desktop Services Tampering Vulnerability
CVE-2024-43444: High severity, CVSS 8.2 | Vulnix