CVE-2005-3895: XSS
Open Ticket Request System (OTRS) 1.0.0 through 1.3.2 and 2.0.0 through 2.0.3, when AttachmentDownloadType is set to inline, renders text/html e-mail attachments as HTML in the browser when the queue moderator attempts to download the attachment, which allows remote attackers to execute arbitrary web script or HTML. NOTE: this particular issue is referred to as XSS by some sources.
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2005-3895?
CVE-2005-3895 has a medium severity rating due to the potential for remote code execution.
How do I fix CVE-2005-3895?
To fix CVE-2005-3895, update OTRS to a version that does not use the inline attachment download type or apply the available security patches.
What software versions are affected by CVE-2005-3895?
CVE-2005-3895 affects OTRS versions 1.0.0 to 1.3.2 and 2.0.0 to 2.0.3.
What kind of vulnerability is CVE-2005-3895?
CVE-2005-3895 is a remote code execution vulnerability caused by improper handling of text/html email attachments.
Can CVE-2005-3895 be exploited by an attacker?
Yes, an attacker can exploit CVE-2005-3895 by sending a specially crafted email with an HTML attachment.