CVE-2019-9752: XSS
An issue was discovered in Open Ticket Request System (OTRS) 5.x before 5.0.34, 6.x before 6.0.16, and 7.x before 7.0.4. An attacker who is logged into OTRS as an agent or a customer user may upload a carefully crafted resource in order to cause execution of JavaScript in the context of OTRS. This is related to Content-type mishandling in Kernel/Modules/PictureUpload.pm.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2019-9752?
CVE-2019-9752 is classified as a high severity vulnerability due to the risk of arbitrary JavaScript execution in the context of the OTRS application.
How do I fix CVE-2019-9752?
To fix CVE-2019-9752, you should upgrade to OTRS version 5.0.34, 6.0.16, or 7.0.4 respectively, or apply relevant patches provided by the vendor.
Who is affected by CVE-2019-9752?
CVE-2019-9752 affects users of OTRS versions earlier than 5.0.34, 6.0.16, and 7.0.4, specifically agents and customers logged into the system.
What kind of attack is associated with CVE-2019-9752?
CVE-2019-9752 involves an attacker leveraging a logged-in session to upload crafted resources that can execute JavaScript within OTRS.
What are the potential impacts of CVE-2019-9752?
The potential impacts of CVE-2019-9752 include unauthorized access to sensitive data and compromise of user sessions through JavaScript execution.