Headline

CVE-2018-17883: Security Advisory 2018-06: Security Update for OTRS Framework - ((OTRS)) Community Edition

An issue was discovered in Open Ticket Request System (OTRS) 6.0.x before 6.0.12. An attacker could send an e-mail message with a malicious link to an OTRS system or an agent. If a logged-in agent opens this link, it could cause the execution of JavaScript in the context of OTRS.

1 year ago

CVE

Open in Source

#xss #vulnerability #java

Release Notes

OTRS Group, the world’s leading provider of the OTRS service management suite, including the fully managed OTRS solution and the ITIL® V3-compliant IT service management software OTRS::ITSM.

05/10/2018
Security Advisories

October 05, 2018 — Please read carefully and check if the version of your OTRS system is affected by this vulnerability.

Security Advisory Details

ID: OSA-2018-06
Date: 2018-10-05
Title: XSS
Severity: 3.9. low
Product: OTRS 6.0.x
Fixed in: OTRS 6.0.12
FULL CVSS v3 VECTOR: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C
References: CVE-2018-17883

Vulnerability Description

This advisory covers vulnerabilities discovered in the OTRS framework.

Privilege Escalation

An attacker could send an email with a malicious link to an OTRS system or an agent. If a logged in agent opens this link, it could cause the execution of JavaScript in the context of OTRS.

Affected by this vulnerability are all releases of OTRS 6.0.x up to and including 6.0.11.

Release Name:

Security Advisory 2018-06: Security Update for OTRS Framework

PGP Key