PT-2023-10709 · Otrs · Open Ticket Request System

Publicado 2023-04-15 · Atualizado 2023-04-26 · CVE-2018-17883

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Open Ticket Request System (OTRS) versions 6.0.x through 6.0.11

Description An issue was discovered in Open Ticket Request System (OTRS) where an attacker could send an e-mail message with a malicious link to an OTRS system or an agent. If a logged-in agent opens this link, it could cause the execution of JavaScript in the context of OTRS.

Recommendations For Open Ticket Request System (OTRS) versions 6.0.x through 6.0.11, update to version 6.0.12 or later to resolve the issue.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2018-17883

Produtos afetados

Open Ticket Request System

Referências · 11

• https://github.com/OTRS/otrs/commit/40bbcc261a77c2f4c0383658cd99c07d577179ce · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-17883 · Nota de Segurança
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-17883 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2018-17883 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2018-17883 · Aviso do Fabricante
• https://community.otrs.com/category/release-and-security-notes-en · Nota
• https://cve.org/CVERecord?id=CVE-2018-17883 · Nota de Segurança
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-17883 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2018-17883 · Aviso do Fabricante
• https://community.otrs.com/security-advisory-2018-06-security-update-for-otrs-framework · Aviso do Fabricante
• https://t.me/cvenotify/48355 · Publicação no Telegram