CVE-2021-21434: XSS in Survey Module
Survey administrator can craft a survey in such way that malicious code can be executed in the agent interface (i.e. another agent who wants to make changes in the survey). This issue affects: OTRS AG Survey 6.0.x version 6.0.20 and prior versions; 7.0.x version 7.0.19 and prior versions.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is CVE-2021-21434?
CVE-2021-21434 is a vulnerability that allows a survey administrator to craft a survey in such a way that malicious code can be executed in the agent interface, affecting OTRS AG Survey 6.0.x version 6.0.20 and prior versions, and 7.0.x version 7.0.19 and prior versions.
What is the severity of CVE-2021-21434?
The severity of CVE-2021-21434 is medium, with a severity value of 4.8.
How does CVE-2021-21434 affect OTRS AG Survey?
CVE-2021-21434 affects OTRS AG Survey 6.0.x version 6.0.20 and prior versions, as well as 7.0.x version 7.0.19 and prior versions.
How can the vulnerability be exploited?
The vulnerability can be exploited by a survey administrator crafting a survey in such a way that malicious code can be executed in the agent interface.
Is there a fix available for CVE-2021-21434?
Yes, a fix is available for CVE-2021-21434. Users should update to OTRS AG Survey version 6.0.21 or version 7.0.20 to mitigate the vulnerability.