CVE-2019-16375: XSS
An issue was discovered in Open Ticket Request System (OTRS) 7.0.x through 7.0.11, and Community Edition 5.0.x through 5.0.37 and 6.0.x through 6.0.22. An attacker who is logged in as an agent or customer user with appropriate permissions can create a carefully crafted string containing malicious JavaScript code as an article body. This malicious code is executed when an agent composes an answer to the original article.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2019-16375.
What is the severity of CVE-2019-16375?
The severity of CVE-2019-16375 is medium with a CVSS score of 5.4.
What is the affected software?
The affected software includes Open Ticket Request System (OTRS) versions 5.0.x through 5.0.37, 6.0.x through 6.0.22, and 7.0.x through 7.0.11, as well as OTRS Community Edition.
What is the description of CVE-2019-16375?
CVE-2019-16375 is a vulnerability in Open Ticket Request System (OTRS) that allows an attacker with appropriate permissions to create a malicious string containing JavaScript code.
Are there any references for CVE-2019-16375?
Yes, you can find more information about CVE-2019-16375 at the following references: [Link 1](http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00038.html), [Link 2](http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00066.html), [Link 3](http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00077.html).