CVE-2022-32741: Otrs

Medium severity, CVSS 5.3. EPSS: 0.8% chance of exploitation in the next 30 days.

Attacker is able to determine if the provided username exists (and it's valid) using Request New Password feature, based on the response time.

Affected products

• Otrs Otrs: from 7.0.0, before 7.0.35 (fixed in 7.0.35); from 8.0.0, before 8.0.23 (fixed in 8.0.23)

Published 2022-06-13. Last modified 2026-06-17.