CVE-2019-16375: XSS
First published: Thu Mar 19 2020(Updated: )
An issue was discovered in Open Ticket Request System (OTRS) 7.0.x through 7.0.11, and Community Edition 5.0.x through 5.0.37 and 6.0.x through 6.0.22. An attacker who is logged in as an agent or customer user with appropriate permissions can create a carefully crafted string containing malicious JavaScript code as an article body. This malicious code is executed when an agent composes an answer to the original article.
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Otrs Otrs | >=5.0.0<=5.0.37 | |
| Otrs Otrs | >=6.0.0<=6.0.22 | |
| Otrs Otrs | >=7.0.0<=7.0.11 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00038.html
- http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00066.html
- http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00077.html
- https://community.otrs.com/category/security-advisories-en/
- https://lists.debian.org/debian-lts-announce/2023/08/msg00040.html
- https://otrs.com/release-notes/otrs-security-advisory-2019-13/
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2019-16375.
What is the severity of CVE-2019-16375?
The severity of CVE-2019-16375 is medium with a CVSS score of 5.4.
What is the affected software?
The affected software includes Open Ticket Request System (OTRS) versions 5.0.x through 5.0.37, 6.0.x through 6.0.22, and 7.0.x through 7.0.11, as well as OTRS Community Edition.
What is the description of CVE-2019-16375?
CVE-2019-16375 is a vulnerability in Open Ticket Request System (OTRS) that allows an attacker with appropriate permissions to create a malicious string containing JavaScript code.
Are there any references for CVE-2019-16375?
Yes, you can find more information about CVE-2019-16375 at the following references: [Link 1](http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00038.html), [Link 2](http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00066.html), [Link 3](http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00077.html).
- agent/author
- agent/description
- agent/event
- agent/first-publish-date
- agent/last-modified-date
- agent/references
- agent/severity
- agent/softwarecombine
- agent/tags
- agent/type
- agent/weakness
- collector/nvd-api
- collector/nvd-index
- vendor/otrs
- canonical/otrs otrs
- version/otrs otrs/5.0.0
- version/otrs otrs/5.0.37
- version/otrs otrs/6.0.0
- version/otrs otrs/6.0.22
- version/otrs otrs/7.0.0
- version/otrs otrs/7.0.11