title: Spoofing of From field in several screens
description: An improper control of parameters allows the spoofing of the from fields of the following screens: AgentTicketCompose, AgentTicketForward, AgentTicketBounce and AgentTicketEmailOutbound. This issue affects: ((OTRS)) Community Edition 5.0.x version 5.0.39 and prior versions; 6.0.x version 6.0.24 and prior versions. OTRS 7.0.x version 7.0.13 and prior versions.
problem types: CWE-472 External Control of Assumed-Immutable Web Parameter
affected:
{
vendor: OTRS AG
product: ((OTRS)) Community Edition
versions:
version: 5.0.x version 5.0.39 and prior versions, status: affected
version: 6.0.x version 6.0.24 and prior versions, status: affected
}
{
vendor: OTRS AG
product: OTRS
versions:
version: 7.0.x version 7.0.13 and prior versions, status: affected
}
metrics:
cvssV3_1: [
version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: LOW
availabilityImpact: NONE
baseScore: 3.5
baseSeverity: LOW
]
solutions: Upgrade to OTRS 7.0.14, ((OTRS)) Community Edition 6.0.25, ((OTRS)) Community Edition 5.0.40