Cross-Site Scripting (XSS) Vulnerability Affects OTRS and Community Edition
CVE-2024-43443

4.9MEDIUM

Key Information:

Vendor
Otrs Ag
Status
Otrs
((otrs)) Community Edition
Vendor
CVE Published:
26 August 2024

Summary

Improper Neutralization of Input done by an attacker with admin privileges ('Cross-site Scripting') in Process Management modules of OTRS and ((OTRS)) Community Edition allows Cross-Site Scripting (XSS) within the Process Management targeting other admins. This issue affects:

  • OTRS from 7.0.X through 7.0.50
  • OTRS 8.0.X
  • OTRS 2023.X
  • OTRS from 2024.X through 2024.5.X
  • ((OTRS)) Community Edition: 6.0.x

Products based on the ((OTRS)) Community Edition also very likely to be affected

Affected Version(s)

((OTRS)) Community Edition 6.0.x

OTRS 7.0.x <= 7.0.50

OTRS 8.0.x

References

https://otrs.com/release-notes/otrs-security-advisory-202...

CVSS V3.1

Score:
4.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Special thanks to Marek Holka for reporting these vulnerability.
.