CVE-2025-24388

Unsafe handling of AJAX calls

State: Published
Severity: 3.8 Low
Published: Jun 16, 2025
Updated: Jun 16, 2025
Reserved: Jan 21, 2025

Description

A vulnerability in the OTRS Admin Interface and Agent Interface (versions before OTRS 8) allow parameter injection due to for an autheniticated agent or admin user.

This issue affects:

* OTRS 7.0.X

* OTRS 8.0.X * OTRS 2023.X * OTRS 2024.X * OTRS 2025.X

* ((OTRS)) Community Edition: 6.0.x

Products based on the ((OTRS)) Community Edition also very likely to be affected

Scores

CVSS	Score	Vector	Source
3.1	3.8 Low	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L	OTRS

Weaknesses

CWE-184 Incomplete List of Disallowed Inputs

Affected Products

Product	Versions
OTRSOTRS AG	7.0.xAffected 8.0.xAffected 2023.xAffected 2024.xAffected 2025.x through 2025.5.1Affected
((OTRS)) Community EditionOTRS AG	6.0.xAffected

References

https://otrs.com/release-notes/otrs-security-advisory-2025-06/

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.