What’s Vulnerable › Vulnerabilities

CVE-2019-18180: Denial of service

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2019-12-05 · updated 2026-06-17
• Weakness: CWE-835

Description

Improper Check for filenames with overly long extensions in PostMaster (sending in email) or uploading files (e.g. attaching files to mails) of ((OTRS)) Community Edition and OTRS allows an remote attacker to cause an endless loop. This issue affects: OTRS AG: ((OTRS)) Community Edition 5.0.x version 5.0.38 and prior versions; 6.0.x version 6.0.23 and prior versions. OTRS AG: OTRS 7.0.x version 7.0.12 and prior versions.

Affected products

• OTRS AG OTRS: from 5.0.0 before 5.0.39; from 6.0.0 before 6.0.24; from 7.0.0 before 7.0.13 — fixed in 5.0.39, 6.0.24, 7.0.13

How to fix

Upgrade to a fixed version: OTRS AG OTRS 5.0.39, 6.0.24, 7.0.13. Check the vendor advisory for mitigations.

References

• http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00038.html
• http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00066.html
• http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00077.html
• https://community.otrs.com/security-advisory-2019-15-security-update-for-otrs-framework/
• https://lists.debian.org/debian-lts-announce/2023/08/msg00040.html
• http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00038.html
• http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00066.html
• http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00077.html
• https://community.otrs.com/security-advisory-2019-15-security-update-for-otrs-framework/
• https://lists.debian.org/debian-lts-announce/2023/08/msg00040.html

Get alerted when CVE-2019-18180 or the next vulnerability affects your stack