CVE-2024-23791

What it actually does

Debug information containing sensitive article content is written to log files during Elasticsearch index construction, exposing confidential data to any party with log access.

Why it matters to the business

Unauthorized disclosure of internal article information can lead to data leaks, regulatory penalties, and loss of customer trust; low EPSS and lack of KEV status indicate limited active exploitation risk but still requires prompt patching across Debian-based deployments.

How an attack unfolds

An unauthenticated attacker triggers Elasticsearch index rebuilding through public interfaces; the resulting debug logs containing article data are then read from accessible log files or storage.

How to fix it

Upgrade the affected package on Debian 13 to version 6.9.7-1 or later; additionally apply OTRS updates beyond 7.0.48, 8.0.37, or 2023.1.1 where applicable.

How to confirm the fix worked

Confirm package version is at least 6.9.7-1, review logs for absence of article debug data during index builds, and verify no sensitive content appears in Elasticsearch-related logs.

Typical attack path

1. Send requests that initiate Elasticsearch index building on the OTRS instance
2. Locate and access log files generated during the index process
3. Parse debug entries to extract sensitive article information

How to detect it

Search application and system logs for debug entries generated during Elasticsearch index builds that include article text or metadata; correlate with access attempts to log directories.

What your security team should do

• Apply the 6.9.7-1 package update immediately on all Debian 13 systems running affected OTRS versions
• Audit log file permissions and restrict access to Elasticsearch build logs
• Monitor EPSS trend and CISA KEV for any future changes indicating increased risk