CVE-2025-24387: Otrs

Medium severity, CVSS 6.5. EPSS: 0.2% chance of exploitation in the next 30 days.

A vulnerability in OTRS Application Server allows session hijacking due to missing attributes for sensitive cookie settings in HTTPS sessions. A request to an OTRS endpoint from a possible malicious web site, would send the authentication cookie, performing an unwanted read operation.   This issue affects: * OTRS 7.0.X * OTRS 8.0.X * OTRS 2023.X * OTRS 2024.X * OTRS 2025.x

Affected products

• Otrs Otrs: from 7.0.0, up to and including 2025.1.2

Published 2025-03-10. Last modified 2026-06-17.