CVEvulnerability
CVE-2019-9752
5.4 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2019-03-13
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 5.4 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
- CVSS 2.0 ([email protected])
- 3.5 LOW — AV:N/AC:M/Au:S/C:N/I:P/A:N
- Weaknesses
- CWE-79
Description
An issue was discovered in Open Ticket Request System (OTRS) 5.x before 5.0.34, 6.x before 6.0.16, and 7.x before 7.0.4. An attacker who is logged into OTRS as an agent or a customer user may upload a carefully crafted resource in order to cause execution of JavaScript in the context of OTRS. This is related to Content-type mishandling in Kernel/Modules/PictureUpload.pm.
Affected configurations
• otrs otrs (>= 5.0.0 < 5.0.34)
• otrs otrs (>= 6.0.0 < 6.0.16)
• otrs otrs (>= 7.0.0 < 7.0.4)
• opensuse backports sle 15.0
• opensuse leap 15.1
• opensuse leap 15.2
Related
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00038.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00066.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00077.html Mailing List, Third Party Advisory
- https://community.otrs.com/security-advisory-2019-01-security-update-for-otrs-framework Patch, Vendor Advisory
- https://lists.debian.org/debian-lts-announce/2019/03/msg00023.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00038.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00066.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00077.html Mailing List, Third Party Advisory
- https://community.otrs.com/security-advisory-2019-01-security-update-for-otrs-framework Patch, Vendor Advisory
- https://lists.debian.org/debian-lts-announce/2019/03/msg00023.html Mailing List, Third Party Advisory