Headline

CVE-2023-5421: OTRS Security Advisory 2023-09 | OTRS

An attacker who is logged into OTRS as an user with privileges to create and change customer user data may manipulate the CustomerID field to execute JavaScript code that runs immediatly after the data is saved.The issue onlyoccurs if the configuration for AdminCustomerUser::UseAutoComplete was changed before. This issue affects OTRS: from 7.0.X before 7.0.47, from 8.0.X before 8.0.37; ((OTRS)) Community Edition: from 6.0.X through 6.0.34.

1 year ago

CVE

Open in Source

#xss #vulnerability #java

Please read carefully and check if the version of your OTRS system is affected by this vulnerability.

Please send information regarding vulnerabilities in OTRS to: [email protected]

PGP Key

pub 2048R/9C227C6B 2011-03-21
uid OTRS Security Team <[email protected]>
GPG Fingerprint E330 4608 DA6E 34B7 1551 C244 7F9E 44E9 9C22 7C6B

Security Advisory Details

ID: OSA-2023-09
Date: 2023-10-16
Title: Possible XSS execution in customer information
Severity: 3.5 LOW
Product: OTRS 7.0.x, OTRS 8.0.x
Fixed in: OTRS 7.0.47, OTRS 8.0.37
FULL CVSS v3.1 VECTOR: CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N
References: CVE-2023-5421

OSA-2023-09 Possible XSS executed in customer information (CVE-2023-5421)

An attacker who is logged into OTRS as an user with privileges to create and change customer user data may manipulate the CustomerID field to execute JavaScript code that runs immediatly after the data is saved. The issue only occurs if the configuration for AdminCustomerUser::UseAutoComplete was changed before.

PRODUCT AFFECTED:

This issue affects

OTRS: from 7.0.X before 7.0.47,
OTRS: from 8.0.X before 8.0.37
((OTRS)) Community Edition: from 6.0.X through 6.0.34.

PROBLEM:

CWE-20 Improper Input Validation CWE-20

Impact:

CAPEC-63 Cross-Site Scripting (XSS) CAPEC-63

Product Status

OTRS AG OTRS » Agent interface

Default status is affected

from 7.0.x before 7.0.47

from 8.0.x before 8.0.37