Headline

CVE-2019-10067: Security Advisory 2019-05: Security Update for OTRS Framework - ((OTRS)) Community Edition

An issue was discovered in Open Ticket Request System (OTRS) 7.x through 7.0.6 and Community Edition 5.0.x through 5.0.35 and 6.0.x through 6.0.17. An attacker who is logged into OTRS as an agent user with appropriate permissions may manipulate the URL to cause execution of JavaScript in the context of OTRS.

5 years ago

CVE

Open in Source

#xss #vulnerability #java

Release Notes

OTRS Group, the world’s leading provider of the OTRS service management suite, including the fully managed OTRS solution and the ITIL® V3-compliant IT service management software OTRS::ITSM.

26/04/2019
Security Advisories

April 26, 2019 — Please read carefully and check if the version of your OTRS system is affected by this vulnerability.

Security Advisory Details

ID: OSA-2019-05
Date: 2019-04-26
Title: Reflected and Stored XSS
Severity: 3.1 low
Product: OTRS 7.0.x, OTRS 6.0.x, OTRS 5.0.x
Fixed in: OTRS 7.0.7, OTRS 6.0.18, OTRS 5.0.35
FULL CVSS v3 VECTOR: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:R
References: CVE-2019-10067

Vulnerability Description

This advisory covers vulnerabilities discovered in the OTRS framework.

Privilege Escalation

An attacker who is logged into OTRS as an agent user with appropriate permissions may manipulate the URL to cause execution of JavaScript in the context of OTRS.

Affected by this vulnerability are all releases of OTRS 7.0.x up to and including 7.0.6, OTRS 6.0.x up to and including 6.0.17 and OTRS 5.0.x up to and including 5.0.35.

This vulnerability is fixed in the latest versions of OTRS, and it is recommended to upgrade to the latest patch level.

Release Name:

Security Advisory 2019-05: Security Update for OTRS Framework

PGP Key