CVE-2023-5422
Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.
NVD · uneditedThe functions to fetch e-mail via POP3 or IMAP as well as sending e-mail via SMTP use OpenSSL for static SSL or TLS based communication. As the SSL_get_verify_result() function is not used the certificated is trusted always and it can not be ensured that the certificate satisfies all necessary security requirements. This could allow an attacker to use an invalid certificate to claim to be a trusted host, use expired certificates, or conduct other attacks that could be detected if the certificate is properly validated. This issue affects OTRS: from 7.0.X before 7.0.47, from 8.0.X before 8.0.37; ((OTRS)) Community Edition: from 6.0.X through 6.0.34.
Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.
dbcve analysis · high confidenceOTRS fails to validate SSL/TLS certificates when connecting to mail servers via POP3, IMAP, or SMTP. The code does not call SSL_get_verify_result(), causing all certificates to be implicitly trusted regardless of validity, expiration, or whether they belong to the claimed host. This enables man-in-the-middle attacks where an attacker can intercept encrypted mail traffic using invalid or forged certificates.
Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.
Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.
NVD · CPE data>= 6.0.0, <= 6.0.34>= 7.0.0, < 7.0.47>= 8.0.0, < 8.0.37CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.
From the vector- Attack vector
- Network
- Complexity
- Low
- Privileges
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- None
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.
dbcve checksWork through these to decide whether this CVE applies to you.
-
Determine installed OTRS versionLocate the OTRS version file (typically Kernel/Framework.pm in the OTRS installation directory) or run: perl -MKernel::System::Main -e 'print Kernel::System::Main->Version() . "\n";' from the OTRS home directory. Alternatively, check the about page in the OTRS admin interface.Affected if The installed version falls within >= 6.0.0 and <= 6.0.34, >= 7.0.0 and < 7.0.47, or >= 8.0.0 and < 8.0.37.
-
Identify mail accounts using SSL/TLSAccess the OTRS admin interface and navigate to PostMaster Mail Accounts. Review each configured POP3 or IMAP account and check if SSL/TLS is enabled in the account settings. Also check the SMTP configuration under Email > Send Settings to see if SSL/TLS is configured for outbound mail.Affected if Any mail account is configured with SSL or TLS enabled for POP3, IMAP, or SMTP connections.
-
Locate SSL handler code for mail protocolsIn the OTRS installation directory, locate the Perl modules handling POP3, IMAP, and SMTP connections. Look for files such as Kernel/System/Mail.pm, Kernel/System/Email.pm, or similar modules under the Kernel/System directory that handle POP3/IMAP/SMTP. Search within these files for SSL-related code.Affected if The SSL handler code does not contain a call to SSL_get_verify_result() to validate the server certificate.
-
Verify certificate validation is implementedWithin the identified mail SSL handling code, search for the function SSL_get_verify_result(). If this function is absent from the SSL verification routine, the vulnerability is present. Also check for any verify_callback or SSL_verify_mode configurations that may be set to SSL_VERIFY_NONE.Affected if SSL_get_verify_result() is not called, or SSL_verify_mode is set to a mode that does not validate certificates (such as SSL_VERIFY_NONE).
You are affected if your OTRS version is within the affected ranges AND you have any POP3, IMAP, or SMTP accounts configured with SSL/TLS enabled, and the SSL verification code lacks proper certificate validation.
Generated from the published advisory. Verify against your own configuration.
Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.
dbcve · scoped7.0.478.0.37
Apply vendor patches (OTRS 7.0.47+/8.0.37+, OTRS CE 6.0.35+) which implement proper certificate validation via SSL_get_verify_result(). Until patched, avoid using OTRS for sensitive email communications over untrusted networks.
OTRS 6.0.x → 6.0.35+ (or migrate to 7.0.47+/8.0.37+); OTRS 7.0.x → 7.0.47; OTRS 8.0.x → 8.0.37
- Identify your current OTRS version via admin panel or bin/otrs.Console.pl Admin::Package::List
- For OTRS 6.0.x (versions 6.0.0-6.0.34): Either upgrade to 6.0.35+ or migrate to a supported branch (7.0.47+ or 8.0.37+)
- For OTRS 7.0.x (versions 7.0.0-7.0.46): Upgrade to version 7.0.47 or later
- For OTRS 8.0.x (versions 8.0.0-8.0.36): Upgrade to version 8.0.37 or later
- Before upgrading, perform a complete backup of the OTRS database and configuration files
- Review OTRS upgrade documentation for your specific version transition
- Execute the upgrade following official OTRS upgrade procedures
- After upgrade, verify SSL/TLS certificate validation is functioning for POP3, IMAP, and SMTP connections
Generated from the published advisory — verify against the referenced sources before acting.
- Consultation4.0 h
- Implementation12.0 h
- Testing10.0 h
- Review / QA4.0 h
An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $8,288.
Scan for this in your stack
Free · runs locallyCheck whether your project pulls in CVE-2023-5422 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.
References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.
Primary sourcesPractitioner notes
ContributedPeer-ranked notes from engineers who’ve handled CVE-2023-5422 in production — separate from our analysis above.
The advisory tells you what broke. It rarely tells you what actually worked. If you’ve dealt with this one, that detail is what the next engineer is searching for.
- The version that genuinely resolved it — not the one the vendor claimed
- A config change or rule that shut the vector down
- A gotcha in the upgrade path that cost you an afternoon
No notes yet
Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.
A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.
- Verified mitigations, workarounds, and config changes
- Version or environment caveats, and links to real fixes
- No weaponised exploit code, or anything meant to cause harm
- No spam, self-promotion, credentials, or personal data