OTRS and OTRS Community Edition Missing X-Content-Type-Options Header Vulnerability

A vulnerability exists in OTRS and OTRS Community Edition that involves the absence of the X-Content-Type-Options HTTP response header, which is crucial for preventing MIME type sniffing. This flaw allows an attacker to upload or insert content that could be misinterpreted as a different MIME type than intended. The vulnerability affects OTRS versions 7.0.X, 8.0.X, 2023.X, and 2024.X, as well as OTRS Community Edition 6.0.x. Additionally, products based on OTRS Community Edition are likely affected.

Impact

Exploitation of this vulnerability could lead to content spoofing, where uploaded or inserted content is misrepresented due to incorrect MIME type handling.

Remediation

Users are advised to update to OTRS version 2025.1.x. Note that there will be no patches for OTRS 7.