What’s Vulnerable › Vulnerabilities

CVE-2023-38056: Code execution via System Configuration

• Severity: high (CVSS 7.2 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.9% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-07-24 · updated 2026-06-17
• Weakness: CWE-78

Description

Improper Neutralization of commands allowed to be executed via OTRS System Configuration e.g. SchedulerCronTaskModule using UnitTests modules allows any authenticated attacker with admin privileges local execution of Code.This issue affects OTRS: from 7.0.X before 7.0.45, from 8.0.X before 8.0.35; ((OTRS)) Community Edition: from 6.0.1 through 6.0.34.

Affected products

• OTRS AG OTRS: from 6.0.1 through 6.0.34; from 7.0.0 before 7.0.45; from 8.0.0 before 8.0.35 — fixed in 7.0.45, 8.0.35

How to fix

Upgrade to a fixed version: OTRS AG OTRS 7.0.45, 8.0.35. Check the vendor advisory for mitigations.

References

• https://otrs.com/release-notes/otrs-security-advisory-2023-05/
• https://otrs.com/release-notes/otrs-security-advisory-2023-05/

Get alerted when CVE-2023-38056 or the next vulnerability affects your stack