CVE-2020-1771: Possible XSS in Customer user address book
First published: Fri Mar 27 2020(Updated: )
Attacker is able craft an article with a link to the customer address book with malicious content (JavaScript). When agent opens the link, JavaScript code is executed due to the missing parameter encoding. This issue affects: ((OTRS)) Community Edition: 6.0.26 and prior versions. OTRS: 7.0.15 and prior versions.
Credit: security@otrs.com security@otrs.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Otrs Otrs | >=5.0.0<=5.0.41 | |
| Otrs Otrs | >=6.0.0<=6.0.26 | |
| Otrs Otrs | >=7.0.0<=7.0.15 |
Remedy
Upgrade to OTRS 7.0.16, ((OTRS)) Community Edition 6.0.27 Patch for ((OTRS)) Community Edition 6: https://github.com/OTRS/otrs/commit/2576830053f70a3a9251558e55f34843dec61aa2
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00038.html
- http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00066.html
- http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00077.html
- https://lists.debian.org/debian-lts-announce/2023/08/msg00040.html
- https://otrs.com/release-notes/otrs-security-advisory-2020-08/
Frequently Asked Questions
What is CVE-2020-1771?
CVE-2020-1771 is a vulnerability where an attacker can craft an article with a link to the customer address book with malicious content (JavaScript), which gets executed when the agent opens the link due to the missing parameter encoding.
Which versions of ((OTRS)) Community Edition are affected by CVE-2020-1771?
((OTRS)) Community Edition versions 6.0.26 and prior, as well as version 7.0.15 and prior, are affected by CVE-2020-1771.
What is the severity of CVE-2020-1771?
The severity of CVE-2020-1771 is medium with a CVSS score of 5.4.
How can I fix CVE-2020-1771?
To fix CVE-2020-1771, update to ((OTRS)) Community Edition version 6.0.27 or 7.0.16 or a later version.
What is CWE-79?
CWE-79 is a vulnerability in which an attacker can inject malicious scripts into web pages viewed by users.
- collector/nvd-api
- collector/nvd-index
- agent/author
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/title
- agent/remedy
- agent/weakness
- agent/severity
- agent/last-modified-date
- agent/tags
- agent/description
- agent/first-publish-date
- agent/event
- vendor/otrs
- canonical/otrs otrs
- version/otrs otrs/5.0.0
- version/otrs otrs/5.0.41
- version/otrs otrs/6.0.0
- version/otrs otrs/6.0.26
- version/otrs otrs/7.0.0
- version/otrs otrs/7.0.15