PT-2005-5581 · Otrs · Open Ticket Request System
Moritz Naumann
·
Publicado
1970-01-01
·
Atualizado
2017-07-20
·
CVE-2005-3894
CVSS v2.0
7.5
Alta
| Vetor | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
Open Ticket Request System (OTRS) versions 1.0.0 through 1.3.2
Open Ticket Request System (OTRS) versions 2.0.0 through 2.0.3
Description
The issue involves multiple cross-site scripting (XSS) vulnerabilities that allow remote authenticated users to inject arbitrary web script or HTML. This can be achieved via hex-encoded values in the
QueueID parameter and Action parameters. The vulnerability can lead to a disruption of confidentiality, integrity, and availability of protected information and can be exploited remotely.Recommendations
For Open Ticket Request System (OTRS) versions 1.0.0 through 1.3.2, consider disabling the
QueueID and Action parameters in the index.pl file until a patch is available.
For Open Ticket Request System (OTRS) versions 2.0.0 through 2.0.3, consider disabling the QueueID and Action parameters in the index.pl file until a patch is available.
As a temporary workaround, restrict access to the index.pl file to minimize the risk of exploitation.Exploit
Correção
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Open Ticket Request System