What’s Vulnerable › Vulnerabilities

CVE-2022-0474: Disclosure of mail addresses

• Severity: low (CVSS 3.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-02-07 · updated 2026-06-17
• Weakness: CWE-200

Description

Full list of recipients from customer users in a contact field could be disclosed in notification emails event when the notification is set to be sent to each recipient individually. This issue affects: OTRS AG OTRSCustomContactFields 8.0.x version: 8.0.11 and prior versions.

Affected products

• OTRS AG OTRSCustomContactFields: from 8.0.0 before 8.0.12 — fixed in 8.0.12

How to fix

Upgrade to a fixed version: OTRS AG OTRSCustomContactFields 8.0.12. Check the vendor advisory for mitigations.

References

• https://otrs.com/release-notes/otrs-security-advisory-2022-02/
• https://otrs.com/release-notes/otrs-security-advisory-2022-02/

Get alerted when CVE-2022-0474 or the next vulnerability affects your stack