CyberRota Analysis
AI-GeneratedThe OTRS Community Edition is vulnerable due to an authenticated OS command injection flaw in its PGP encryption module, allowing administrators to execute arbitrary operating system commands through crafted PGP binary paths and command options. This vulnerability poses a high risk as it enables attackers to execute commands with the privileges of the web server process, potentially compromising the entire system. Organizations using this software, particularly those with administrative access, should prioritize remediation to mitigate the risk of exploitation.
Original NVD Description
OTRS Community Edition contains an authenticated OS command injection vulnerability in the PGP encryption module that allows administrators to execute arbitrary operating-system commands by supplying crafted values for the PGP binary path and command options. Administrator-supplied configuration values are concatenated without sanitization into a shell command, enabling arbitrary command execution as the web server process user during normal ticket operations after the malicious configuration is deployed.