CVE-2020-1771: Possible XSS in Customer user address book
Attacker is able craft an article with a link to the customer address book with malicious content (JavaScript). When agent opens the link, JavaScript code is executed due to the missing parameter encoding. This issue affects: ((OTRS)) Community Edition: 6.0.26 and prior versions. OTRS: 7.0.15 and prior versions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OTRSto a version that resolves this vulnerability.Fixed in 7.0.16 - Upgrade
Upgrade
OTRSto a version that resolves this vulnerability.Fixed in 6.0.27 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch 2576830053f70a3a9251558e55f34843dec61aa2
Event History
Frequently Asked Questions
What is CVE-2020-1771?
CVE-2020-1771 is a vulnerability where an attacker can craft an article with a link to the customer address book with malicious content (JavaScript), which gets executed when the agent opens the link due to the missing parameter encoding.
Which versions of ((OTRS)) Community Edition are affected by CVE-2020-1771?
((OTRS)) Community Edition versions 6.0.26 and prior, as well as version 7.0.15 and prior, are affected by CVE-2020-1771.
What is the severity of CVE-2020-1771?
The severity of CVE-2020-1771 is medium with a CVSS score of 5.4.
How can I fix CVE-2020-1771?
To fix CVE-2020-1771, update to ((OTRS)) Community Edition version 6.0.27 or 7.0.16 or a later version.
What is CWE-79?
CWE-79 is a vulnerability in which an attacker can inject malicious scripts into web pages viewed by users.