Cross-site scripting in OTRS



Published: 2020-03-19 | Updated: 2021-04-01
Risk Low
Patch available YES
Number of vulnerabilities 1
CVE-ID CVE-2019-16375
CWE-ID CWE-79
Exploitation vector Network
Public exploit N/A
Vulnerable software
Subscribe
OTRS
Web applications / Other software

Vendor otrs.org

Security Bulletin

This security bulletin contains one low risk vulnerability.

1) Cross-site scripting

EUVDB-ID: #VU51860

Risk: Low

CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-16375

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

Description

The vulnerability allows a remote authenticated user to read and manipulate data.

An issue was discovered in Open Ticket Request System (OTRS) 7.0.x through 7.0.11, and Community Edition 5.0.x through 5.0.37 and 6.0.x through 6.0.22. An attacker who is logged in as an agent or customer user with appropriate permissions can create a carefully crafted string containing malicious JavaScript code as an article body. This malicious code is executed when an agent composes an answer to the original article.

Mitigation

Install update from vendor's website.

Vulnerable software versions

OTRS: 1.0.2b

External links

http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00038.html
http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00066.html
http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00077.html
http://community.otrs.com/category/security-advisories-en/
http://otrs.com/release-notes/otrs-security-advisory-2019-13/


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###