PT-2023-10709 · Otrs · Open Ticket Request System

Published 2023-04-15 · Updated 2023-04-26 · CVE-2018-17883

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Open Ticket Request System (OTRS) versions 6.0.x through 6.0.11

Description An issue was discovered in Open Ticket Request System (OTRS) where an attacker could send an e-mail message with a malicious link to an OTRS system or an agent. If a logged-in agent opens this link, it could cause the execution of JavaScript in the context of OTRS.

Recommendations For Open Ticket Request System (OTRS) versions 6.0.x through 6.0.11, update to version 6.0.12 or later to resolve the issue.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2018-17883

Affected Products

Open Ticket Request System

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2018-17883 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-17883 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-17883 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-17883 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2018-17883 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-17883 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2018-17883 · Vendor Advisory
• https://community.otrs.com/security-advisory-2018-06-security-update-for-otrs-framework · Vendor Advisory
• https://github.com/OTRS/otrs/commit/40bbcc261a77c2f4c0383658cd99c07d577179ce · Note
• https://community.otrs.com/category/release-and-security-notes-en · Note
• https://t.me/cvenotify/48355 · Telegram Post