An improper neutralization of user-controllable input in OTRS or ((OTRS)) Community Edition ticket handling allows authenticated attackers to perform reflected cross-site scripting (XSS) attacks via crafted request parameters associated with ticket actions. By injecting malicious JavaScript into manipulated request URLs, attackers can execute arbitrary script code in the context of an authenticated agent session when the crafted link is opened. This issue affects OTRS: * 7.0.x Please note that ((OTRS)) Community Edition 6.x and before are vulnerable. Products based on the ((OTRS)) Community Edition also very likely to be affected
oryginał ENCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:NOtrs
APPOtrs≤ 6.0.327.0.0 – 7.0.49
Powiązane podatności
OTRS / Community Edition: SQL injection z pominięciem uwierzytelnienia
A Vulnerability in OTRS AgentInterface and ExternalInterface allows the reading of plain text passwords which ...
The functions to fetch e-mail via POP3 or IMAP as well as sending e-mail via SMTP use OpenSSL for static SSL o...
Improper Neutralization of commands allowed to be executed via OTRS System Configuration e.g. SchedulerCronTas...
Improper Authorization vulnerability in OTRS AG OTRS 8 (Websocket API backend) allows any as Agent authenticat...