CVE-2019-10067: XSS
An issue was discovered in Open Ticket Request System (OTRS) 7.x through 7.0.6 and Community Edition 5.0.x through 5.0.35 and 6.0.x through 6.0.17. An attacker who is logged into OTRS as an agent user with appropriate permissions may manipulate the URL to cause execution of JavaScript in the context of OTRS.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2019-10067?
CVE-2019-10067 is classified as a high severity vulnerability due to its potential to execute malicious JavaScript in an authenticated context.
How do I fix CVE-2019-10067?
To mitigate CVE-2019-10067, users should upgrade their OTRS installations to versions 5.0.36, 6.0.18, or 7.0.7 or later.
Who is affected by CVE-2019-10067?
CVE-2019-10067 affects agent users of OTRS versions 5.0.x through 5.0.35, 6.0.x through 6.0.17, and 7.x through 7.0.6.
What types of attacks can exploit CVE-2019-10067?
CVE-2019-10067 can be exploited to execute arbitrary JavaScript code in the context of an authenticated user.
What versions of OTRS are vulnerable to CVE-2019-10067?
OTRS versions 5.0.x up to 5.0.35, 6.0.x up to 6.0.17, and 7.x up to 7.0.6 are vulnerable to CVE-2019-10067.