An issue was discovered in Open Ticket Request System (OTRS) 6.0.x through 6.0.7. A carefully constructed email could be used to inject and execute arbitrary stylesheet or JavaScript code in a logged in customer's browser in the context of the OTRS customer panel application.
References
| Link | Resource |
|---|---|
| https://community.otrs.com/security-advisory-2018-02-security-update-for-otrs-framework/ | Patch Vendor Advisory |
| https://lists.debian.org/debian-lts-announce/2019/08/msg00018.html | Mailing List Third Party Advisory |
| https://lists.otrs.org/pipermail/announce/2018/000720.html | Vendor Advisory |
| https://www.otrs.com/category/release-and-security-notes-en/ | Release Notes Vendor Advisory |
| https://community.otrs.com/security-advisory-2018-02-security-update-for-otrs-framework/ | Patch Vendor Advisory |
| https://lists.debian.org/debian-lts-announce/2019/08/msg00018.html | Mailing List Third Party Advisory |
| https://lists.otrs.org/pipermail/announce/2018/000720.html | Vendor Advisory |
| https://www.otrs.com/category/release-and-security-notes-en/ | Release Notes Vendor Advisory |
Configurations
History
21 Nov 2024, 03:43
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://community.otrs.com/security-advisory-2018-02-security-update-for-otrs-framework/ - Patch, Vendor Advisory | |
| References | () https://lists.debian.org/debian-lts-announce/2019/08/msg00018.html - Mailing List, Third Party Advisory | |
| References | () https://lists.otrs.org/pipermail/announce/2018/000720.html - Vendor Advisory | |
| References | () https://www.otrs.com/category/release-and-security-notes-en/ - Release Notes, Vendor Advisory |
Information
Published : 2019-07-08 13:15
Updated : 2024-11-21 03:43
NVD link : CVE-2018-11563
Mitre link : CVE-2018-11563
CVE.ORG link : CVE-2018-11563
JSON object : View
Products Affected
debian
- debian_linux
otrs
- otrs
CWE