Marek Holka

**Name of the Vulnerable Software and Affected Versions** OTRS versions 7.0.X through 7.0.50 OTRS version 8.0.X OTRS version 2023.X OTRS versions 2024.X through 2024.5.X ((OTRS)) Community Edition version 6.0.x **Description** The issue is related to improper neutralization of input, allowing an attacker with admin privileges to perform Cross-Site Scripting (XSS) within the Process Management module, targeting other admins. This can lead to unauthorized access and data theft. Products based on the ((OTRS)) Community Edition are also likely to be affected. **Recommendations** For OTRS versions 7.0.X through 7.0.50, update to a version outside of this range to resolve the issue. For OTRS version 8.0.X, update to a version outside of this range to resolve the issue. For OTRS version 2023.X, update to a version outside of this range to resolve the issue. For OTRS versions 2024.X through 2024.5.X, update to a version outside of this range to resolve the issue. For ((OTRS)) Community Edition version 6.0.x, update to a version outside of this range to resolve the issue. As a temporary workaround, consider restricting access to the Process Management module to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** OTRS versions 7.0.X through 7.0.50 OTRS version 8.0.X OTRS version 2023.X OTRS versions 2024.X through 2024.5.X OTRS Community Edition version 6.0.x **Description** The issue exists due to improper neutralization of input, allowing an attacker with admin privileges to conduct a Cross-Site Scripting (XSS) attack within the System Configuration, targeting other admins. This can be exploited by an attacker to perform actions on behalf of other administrators. **Recommendations** For OTRS versions 7.0.X through 7.0.50, consider disabling the System Configuration modules to minimize the risk of exploitation until a patch is available. For OTRS version 8.0.X, restrict access to the System Configuration to prevent potential XSS attacks. For OTRS version 2023.X, avoid using the System Configuration modules until the issue is resolved. For OTRS versions 2024.X through 2024.5.X, consider implementing additional security measures, such as input validation, to prevent XSS attacks. For OTRS Community Edition version 6.0.x, restrict access to the System Configuration modules to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** PTC Codebeamer (affected versions not specified) **Description** The issue is a cross-site scripting vulnerability that could allow an attacker to inject and execute malicious code. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Sokrates SOWA SowaSQL versions 5.6.1 and earlier **Description** A Cross Site Scripting (XSS) issue exists in OPAC via the `typ` parameter in the "sowacgi.php" API endpoint. **Recommendations** For versions 5.6.1 and earlier, consider restricting access to the `sowacgi.php` API endpoint until a patch is available. As a temporary workaround, avoid using the `typ` parameter in the affected API endpoint.