CVE-2018-16586: Debian Linux

Medium severity, CVSS 4.3. EPSS: 1.5% chance of exploitation in the next 30 days.

In Open Ticket Request System (OTRS) 4.0.x before 4.0.32, 5.0.x before 5.0.30, and 6.0.x before 6.0.11, an attacker could send a malicious email to an OTRS system. If a logged in user opens it, the email could cause the browser to load external image or CSS resources.

Affected products

• Debian Debian Linux: version 8.0 only; version 9.0 only
• Otrs Open Ticket Request System: from 4.0.0, before 4.0.32 (fixed in 4.0.32); from 5.0.0, before 5.0.30 (fixed in 5.0.30); from 6.0.0, before 6.0.11 (fixed in 6.0.11)

Published 2018-09-28. Last modified 2026-06-17.