Information Disclosure in OTRS STORM Document Search

Executive Summary

This vulnerability is caused by incorrect handling of permissions in the STORM powered by OTRS and in OTRS Document Search Article Meta Filters modules. It allows an attacker to gain knowledge about the number of affected Configuration Items (CIs), Service Level Agreements (SLA), and services without having proper access to them.

Useful 0 Not Useful 0

Impact Analysis

The impact of this vulnerability is that an attacker with limited privileges can obtain information about the number of affected CIs, SLAs, and services. Although the attacker does not gain direct access to these resources, the leakage of this information could potentially be used to infer sensitive operational details or assist in further attacks.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate step to mitigate this vulnerability is to update your OTRS installation to version 2026.4.1 or later.

Note that OTRS 7.0.X will not receive further patches, so consider upgrading to a supported version if you are using that series.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability involves incorrect handling of permissions that allows unauthorized users to gain knowledge about certain information (number of affected CIs, SLA, and services) without proper access. This unauthorized information disclosure could potentially impact compliance with data protection standards and regulations such as GDPR and HIPAA, which require strict control over access to sensitive information.

However, the provided information does not explicitly state the direct impact on compliance with these standards or regulations.

Useful 0 Not Useful 0