CVEvulnerability
CVE-2019-10067
5.4 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2019-05-22
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 5.4 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
- CVSS 2.0 ([email protected])
- 3.5 LOW — AV:N/AC:M/Au:S/C:N/I:P/A:N
- Weaknesses
- CWE-79
Description
An issue was discovered in Open Ticket Request System (OTRS) 7.x through 7.0.6 and Community Edition 5.0.x through 5.0.35 and 6.0.x through 6.0.17. An attacker who is logged into OTRS as an agent user with appropriate permissions may manipulate the URL to cause execution of JavaScript in the context of OTRS.
Affected configurations
• otrs otrs (>= 5.0.0 <= 5.0.35)
• otrs otrs (>= 6.0.0 <= 6.0.17)
• otrs otrs (>= 7.0.0 <= 7.0.6)
Related
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00038.html Broken Link
- http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00066.html Broken Link
- http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00077.html Broken Link
- https://community.otrs.com/security-advisory-2019-05-security-update-for-otrs-framework/ Patch, Vendor Advisory
- http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00038.html Broken Link
- http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00066.html Broken Link
- http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00077.html Broken Link
- https://community.otrs.com/security-advisory-2019-05-security-update-for-otrs-framework/ Patch, Vendor Advisory