Possible XSS stored in customer information
Vulnerability Description
An attacker who is logged into OTRS as an admin user may manipulate customer URL field to store JavaScript code to be run later by any other agent when clicking the customer URL link. Then the stored JavaScript is executed in the context of OTRS. The same issue applies for the usage of external data sources e.g. database or ldap
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-39050
Credits & Attribution
The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:
- Special thanks to Aleksey Solovev for reporting these vulnerability.
More from OTRS AG
View All →Affected Vendor
OTRS AG
View all reports →