Missing X-Content-Type-Options: nosniff Header Allows MIME Type Sniffing
Vulnerability Description
A vulnerability exists in OTRS and ((OTRS Community Edition)) that fail to set the HTTP response header X-Content-Type-Options to nosniff. An attacker could exploit this vulnerability by uploading or inserting content that would be treated as a different MIME type than intended. This issue affects: * OTRS 7.0.X * OTRS 8.0.X * OTRS 2023.X * OTRS 2024.X * ((OTRS)) Community Edition: 6.0.x Products based on the ((OTRS)) Community Edition also very likely to be affected
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-43445
Credits & Attribution
The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:
- Special thanks to Alissa Kim for reporting this vulnerability.
More from OTRS AG
View All →Affected Vendor
OTRS AG
View all reports →