CVE-2024-43444

What it actually does

Passwords of agents and customers are displayed in plain text in the OTRS admin log module if certain configurations regarding the authentication sources match and debugging for the authentication backend has been enabled.

Why it matters to the business

Exposure of credentials in logs can lead to unauthorized account access, data breaches, and regulatory compliance violations for organizations relying on the affected OTRS versions.

How an attack unfolds

An attacker gains access to the admin log module under the specific authentication configuration and with backend debugging enabled, allowing direct reading of plaintext passwords from log entries.

How to fix it

Disable debugging for the authentication backend or upgrade OTRS to a version beyond the affected ranges (7.0.50, 8.0.X, 2023.X, 2024.5.X) where the logging behavior has been corrected.

How to confirm the fix worked

Review admin log configurations and sample log entries to confirm plaintext passwords are no longer present; test authentication flows with debug enabled to verify masking.

Typical attack path

1. Identify or induce conditions where authentication backend debugging is enabled and auth source configs match
2. Obtain access to the OTRS admin log module
3. Search logs for credential strings associated with agent or customer accounts
4. Use exposed passwords for further unauthorized access

How to detect it

Search OTRS admin logs and related authentication debug logs for plaintext password entries; review configuration files for enabled auth backend debugging and matching auth sources.

What your security team should do

• Immediately disable authentication backend debug logging if not required
• Audit all OTRS instances for the listed vulnerable versions and prioritize patching
• Monitor admin log access permissions and restrict to minimal necessary roles