CVE-2022-0474

Full list of recipients from customer users in a contact field could be disclosed in notification emails event when the notification is set to be sent to each recipient individually. This issue affects: OTRS AG OTRSCustomContactFields 8.0.x version: 8.0.11 and prior versions.

Score

CVSS 3.1 3.5 Low

Status

Modified - security@otrs.com

Published

2022-02-07

Last modified

2024-09-16

Weaknesses

CWE-200

Affected products

• Custom Contact Fields (Otrs)
• Otrscustomcontactfields (Otrs Ag)

References

• https://otrs.com/release-notes/otrs-security-advisory-2022-02/