CVE-2022-1004: Otrs

Medium severity, CVSS 4.3. EPSS: 0.6% chance of exploitation in the next 30 days.

Accounted time is shown in the Ticket Detail View (External Interface), even if ExternalFrontend::TicketDetailView###AccountedTimeDisplay is disabled.

Affected products

• Otrs Otrs: from 7.0.0, before 7.0.33 (fixed in 7.0.33); from 8.0.0, before 8.0.20 (fixed in 8.0.20)

Published 2022-03-21. Last modified 2026-06-17.