title: Code execution via System Configuration
description: Improper Neutralization of commands allowed to be executed via OTRS System Configuration e.g. SchedulerCronTaskModule using UnitTests modules allows any authenticated attacker with admin privileges local execution of Code.This issue affects OTRS: from 7.0.X before 7.0.45, from 8.0.X before 8.0.35; ((OTRS)) Community Edition: from 6.0.1 through 6.0.34.
problem types: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
affected:
{
defaultStatus: affected
modules: [System Configuration, UnitTests]
product: OTRS
vendor: OTRS AG
versions:
lessThan: 7.0.45, status: affected, version: 7.0.x, versionType: Patch
lessThan: 8.0.35, status: affected, version: 8.0.x, versionType: Patch
}
{
defaultStatus: affected
product: ((OTRS)) Community Edition
vendor: OTRS AG
versions:
lessThanOrEqual: 6.0.34, status: affected, version: 6.0.1, versionType: All
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.2
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
version: 3.1
]
format: CVSS
scenarios: GENERAL
solutions: Update to OTRS 8.0.35 or OTRS 7.0.45