Riskcovery

CVE-2024-43445

Missing X-Content-Type-Options: nosniff Header Allows MIME Type Sniffing

State
Published
Severity
5.4 Medium
Published
Jan 27, 2025
Updated
Feb 12, 2025
Reserved
Aug 13, 2024

Read the record on cve.org

Description

A vulnerability exists in OTRS and ((OTRS Community Edition)) that fail to set the HTTP response header X-Content-Type-Options to nosniff. An attacker could exploit this vulnerability by uploading or inserting content that would be treated as a different MIME type than intended.

This issue affects:

* OTRS 7.0.X

* OTRS 8.0.X * OTRS 2023.X * OTRS 2024.X

* ((OTRS)) Community Edition: 6.0.x

Products based on the ((OTRS)) Community Edition also very likely to be affected

Scores

CVSSScoreVectorSource
3.15.4 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:NOTRS

Weaknesses

  • CWE-20 Improper Input Validation

Affected Products

ProductVersions
OTRSOTRS AG
  • 7.0.xAffected
  • 8.0.xAffected
  • 2023.xAffected
  • 2024.xAffected
  • 2025.x to before 2025.1.xAffected
((OTRS)) Community EditionOTRS AG
  • 6.0.x through 6.0.34Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.