How severe is CVE-2024-23790?

CVE-2024-23790 has a CVSS 3.x base score of 3.5, rated low severity. It is exploitable over network with low attack complexity, requires low privileges and user interaction. Impact on confidentiality is low, integrity none, and availability none.

Is CVE-2024-23790 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (17th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2024-23790?

CVE-2024-23790 affects Otrs. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2024-23790?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2024-23790 have an EU (EUVD) identifier?

Yes. CVE-2024-23790 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-21243.

When was CVE-2024-23790 published?

CVE-2024-23790 was published on 2024-01-29 and last updated on 2026-06-17.

CVE-2024-23790

CVE-2024-23790 is a low-severity vulnerability in Otrs with a CVSS 3.x base score of 3.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-354.

Key facts

Severity: Low (CVSS 3.x base score 3.5)
EPSS exploit prediction: 0% (17th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2024-21243
Weakness: CWE-354
Affected product: Otrs
Published: 2024-01-29
Last modified: 2026-06-17

Description

Improper Input Validation vulnerability in the upload functionality for user avatars allows functionality misuse due to missing check of filetypes. This issue affects OTRS: from 7.0.X through 7.0.48, from 8.0.X through 8.0.37, from 2023 through 2023.1.1.

Frequently asked questions

What is CVE-2024-23790?: Improper Input Validation vulnerability in the upload functionality for user avatars allows functionality misuse due to missing check of filetypes. This issue affects OTRS: from 7.0.X through 7.0.48, from 8.0.X through 8.0.37, from 2023 through 2023.1.1.
How severe is CVE-2024-23790?: CVE-2024-23790 has a CVSS 3.x base score of 3.5, rated low severity. It is exploitable over network with low attack complexity, requires low privileges and user interaction. Impact on confidentiality is low, integrity none, and availability none.
Is CVE-2024-23790 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (17th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2024-23790?: CVE-2024-23790 affects Otrs. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2024-23790?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2024-23790 have an EU (EUVD) identifier?: Yes. CVE-2024-23790 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-21243.
When was CVE-2024-23790 published?: CVE-2024-23790 was published on 2024-01-29 and last updated on 2026-06-17.

References

https://otrs.com/release-notes/otrs-security-advisory-2024-01/

Affected products (1)

cpe:2.3:a:otrs:otrs:*:*:*:*:*:*:*:*

More vulnerabilities in Otrs

CVE-2026-48188 — Critical (CVSS 9.1): An improper Input Validation vulnerability in OTRS or ((OTRS)) Community Edition database layer module allows an…
CVE-2013-4717 — High (CVSS 8.8): Multiple SQL injection vulnerabilities in Open Ticket Request System (OTRS) Help Desk 3.0.x before 3.0.22, 3.1.x before…
CVE-2017-17476 — High (CVSS 8.8): Open Ticket Request System (OTRS) 4.0.x before 4.0.28, 5.0.x before 5.0.26, and 6.0.x before 6.0.3, when cookie support…
CVE-2017-16921 — High (CVSS 8.8): In OTRS 6.0.x up to and including 6.0.1, OTRS 5.0.x up to and including 5.0.24, and OTRS 4.0.x up to and including…
CVE-2017-16664 — High (CVSS 8.8): Code injection exists in Kernel/System/Spelling.pm in Open Ticket Request System (OTRS) 5 before 5.0.24, 4 before…
CVE-2017-15864 — High (CVSS 8.8): In the Agent Frontend in Open Ticket Request System (OTRS) 3.3.x through 3.3.18, with a crafted URL it is possible to…

All CVEs affecting Otrs →

Other CWE-354 vulnerabilities

CVE-2025-11543 — Critical (CVSS 9.8): Improper Validation of Integrity Check Value vulnerability in Sharp Display Solutions projectors allows a attacker may…
CVE-2024-25678 — Critical (CVSS 9.8): In LiteSpeed QUIC (LSQUIC) Library before 4.0.4, DCID validation is mishandled.
CVE-2023-33668 — Critical (CVSS 9.8): DigiExam up to v14.0.2 lacks integrity checks for native modules, allowing attackers to access PII and takeover…
CVE-2017-15994 — Critical (CVSS 9.8): rsync 3.1.3-development before 2017-10-24 mishandles archaic checksums, which makes it easier for remote attackers to…
CVE-2026-49230 — Critical (CVSS 9.1): Improper Validation of Integrity Check Value vulnerability in Apache APISIX. The jwe-decrypt plugin under default…
CVE-2026-34182 — Critical (CVSS 9.1): Issue Summary: Cryptographic Message Services (CMS) processing fails to perform sufficient input validation on the…

Browse all CWE-354 vulnerabilities →