PT-2019-19844 · Otrs+2 · Otrs+2
Publicado
2019-03-13
·
Atualizado
2022-05-03
·
CVE-2019-9752
CVSS v3.1
5.4
Média
| Vetor | AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
Open Ticket Request System (OTRS) versions 5.x through 5.0.33
Open Ticket Request System (OTRS) versions 6.x through 6.0.15
Open Ticket Request System (OTRS) versions 7.x through 7.0.3
Description
An issue was discovered in Open Ticket Request System (OTRS) where an attacker who is logged into OTRS as an agent or a customer user may upload a carefully crafted resource in order to cause execution of JavaScript in the context of OTRS. This is related to Content-type mishandling in Kernel/Modules/PictureUpload.pm.
Recommendations
For versions 5.x through 5.0.33, update to version 5.0.34 or later.
For versions 6.x through 6.0.15, update to version 6.0.16 or later.
For versions 7.x through 7.0.3, update to version 7.0.4 or later.
Correção
XSS
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Otrs
Suse