CVE-2022-32741

Description

Attacker is able to determine if the provided username exists (and it's valid) using Request New Password feature, based on the response time.

Affected Platforms

Weakness Type

CWE-200, NVD-CWE-noinfo

References

• https://otrs.com/release-notes/otrs-security-advisory-2022-09/
• https://otrs.com/release-notes/otrs-security-advisory-2022-09/