CVE-2025-24387: otrs CSRF — Fix

Description

A vulnerability in OTRS Application Server allows session hijacking due to missing attributes for sensitive cookie settings in HTTPS sessions. A request to an OTRS endpoint from a possible malicious web site, would send the authentication cookie, performing an unwanted read operation. This issue affects: * OTRS 7.0.X * OTRS 8.0.X * OTRS 2023.X * OTRS 2024.X * OTRS 2025.x

Is your site exposed to CVE-2025-24387?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

4.8

MEDIUM

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N

Weakness Type (CWE)

CWE-1275 CWE-1275

CWE-352 Cross-Site Request Forgery

Affected Products

Vendor	Product	Versions
otrs	otrs	7.0.0 — 2025.1.2

References

Advisories & Patches

https://otrs.com/release-notes/otrs-security-advisory-2025-05/

Frequently Asked Questions

What is CVE-2025-24387? +

A vulnerability in OTRS Application Server allows session hijacking due to missing attributes for sensitive cookie settings in HTTPS sessions. A request to an OTRS endpoint from a possible malicious web site, would send the authentication cookie, performing an unwanted read operation. This issue affects: * OTRS 7.0.X * OTRS 8.0.X * OTRS 2023.X * OTRS 2024.X * OTRS 2025.x It has a CVSS v3.1 base score of 4.8 (MEDIUM).

How severe is CVE-2025-24387? +

CVE-2025-24387 has a CVSS v3.1 score of 4.8 out of 10, rated MEDIUM. This is a medium-severity vulnerability that should be remediated as part of regular maintenance.

What products are affected by CVE-2025-24387? +

CVE-2025-24387 affects products from otrs, specifically: otrs. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2025-24387? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2023-53957 9.8

Kimai 1.30.10 contains a SameSite cookie vulnerability that allows attackers to steal user session cookies through malicious exploitation. Attackers can …

CVE-2024-6611 9.8

A nested iframe, triggering a cross-site navigation, could send SameSite=Strict or Lax cookies. This vulnerability affects Firefox < 128 and …

CVE-2026-8411 8.8

Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/page/bulk/delete. The Concrete CMS security team …

CVE-2026-8427 8.8

Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file removeFavoriteFolder($id). The Concrete CMS security …

CVE-2026-8432 8.8

Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file star(). The Concrete CMS security …

CVE-2026-8433 8.8

Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file rescan(). The Concrete CMS security …

CVE-2025-24387