CVE-2020-1766: Improper handling of uploaded inline images
Due to improper handling of uploaded images it is possible in very unlikely and rare conditions to force the agents browser to execute malicious javascript from a special crafted SVG file rendered as inline jpg file. This issue affects: ((OTRS)) Community Edition 5.0.x version 5.0.39 and prior versions; 6.0.x version 6.0.24 and prior versions. OTRS 7.0.x version 7.0.13 and prior versions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OTRS Community Editionto a version that resolves this vulnerability.Fixed in 7.0.14Patch b7d80f9000fc9a435743d8d1d7d44d9a17483a9a - Upgrade
Upgrade
OTRS Community Editionto a version that resolves this vulnerability.Fixed in 6.0.25Patch 128078b0bb30f601ed97d4a13906644264ee6013 - Upgrade
Upgrade
OTRS Community Editionto a version that resolves this vulnerability.Fixed in 5.0.40
Event History
Frequently Asked Questions
What is CVE-2020-1766?
CVE-2020-1766 is a vulnerability that allows the execution of malicious JavaScript from a specially crafted SVG file in ((OTRS)) Community Edition.
Which versions of ((OTRS)) Community Edition are affected by CVE-2020-1766?
((OTRS)) Community Edition versions 5.0.0 through 5.0.39, 6.0.0 through 6.0.24, and 7.0.0 through 7.0.13 are affected by CVE-2020-1766.
What is the severity of CVE-2020-1766?
CVE-2020-1766 has a severity rating of 6.1, which is considered medium.
How can I fix CVE-2020-1766?
To fix CVE-2020-1766, upgrade to the latest version of ((OTRS)) Community Edition.
Where can I find more information about CVE-2020-1766?
You can find more information about CVE-2020-1766 in the following references: [Reference 1](http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00038.html), [Reference 2](http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00066.html), [Reference 3](http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00077.html).