XSS in Otrs
CVE-2012-2582
Multiple cross-site scripting (XSS) vulnerabilities in Open Ticket Request System (OTRS) Help Desk 2.4.x before 2.4.13, 3.0.x before 3.0.15, and 3.1.x before 3.1.9, and OTRS ITSM 2.1.x before 2.1.5, 3.0.x before 3.0.6, and 3.1.x before 3.1.6, allow remote attackers to inject arbitrary web script or HTML via an e-mail message body with (1) a Cascading Style Sheets (CSS) expression property in the STYLE attribute of an arbitrary element or (2) UTF-7 text in an HTTP-EQUIV="CONTENT-TYPE" META element.
Vulnerability class: XSS (Cross-Site Scripting)
EPSS: 0.042 (89.9th percentile) — read the EPSS interpretation.
Affected products
- Otrs — versions 2.4.0, 2.4.1, 2.4.2
- Otrs Otrs_itsm — versions 2.1.0, 2.1.1, 2.1.2
- N/a — versions n/a
Weakness classification (CWE)
References
- cret@cert.org (vendor-advisory, x_refsource_SUSE)
- cret@cert.org (x_refsource_CONFIRM, Vendor Advisory)
- cret@cert.org (US Government Resource, x_refsource_CERT-VN, Exploit, third-party-advisory)
- cret@cert.org (x_refsource_SECUNIA, third-party-advisory)
- cret@cert.org (vendor-advisory, x_refsource_DEBIAN)