CVE-2023-38057: XSS stored in survey answers
First published: Mon Jul 24 2023(Updated: )
An improper input validation vulnerability in OTRS Survey modules allows any attacker with a link to a valid and unanswered survey request to inject javascript code in free text answers. This allows a cross site scripting attack while reading the replies as authenticated agent. This issue affects OTRS Survey module from 7.0.X before 7.0.32, from 8.0.X before 8.0.13 and ((OTRS)) Community Edition Survey module from 6.0.X through 6.0.22.
Credit: security@otrs.com security@otrs.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| OTRS Survey | >=6.0.0<=6.0.22 | |
| OTRS Survey | >=7.0.0<7.0.32 | |
| OTRS Survey | >=8.0.0<8.0.13 | |
| Otrs Otrs | >=6.0.0<=6.0.22 | |
| Otrs Otrs | >=7.0.0<7.0.32 | |
| Otrs Otrs | >=8.0.0<8.0.13 |
Remedy
Update Survey package to version 8.0.13 or 7.0.32
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is the vulnerability ID for this OTRS Survey module vulnerability?
The vulnerability ID for this OTRS Survey module vulnerability is CVE-2023-38057.
What is the severity level of CVE-2023-38057?
The severity level of CVE-2023-38057 is medium.
How does the vulnerability in OTRS Survey modules occur?
The vulnerability in OTRS Survey modules occurs due to improper input validation, allowing attackers to inject JavaScript code in free text answers.
Who is affected by this vulnerability?
The vulnerability in OTRS Survey modules affects versions 6.0.0 to 6.0.22, 7.0.0 to 7.0.32, and 8.0.0 to 8.0.13 of the OTRS and OTRS Survey software.
How can I fix the vulnerability in OTRS Survey modules?
To fix the vulnerability in OTRS Survey modules, update to a version of OTRS and OTRS Survey software that is not affected by the vulnerability.
- collector/nvd-index
- agent/weakness
- agent/author
- agent/type
- agent/softwarecombine
- collector/nvd-api
- agent/software-canonical-lookup-request
- collector/nvd-latest
- agent/references
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/remedy
- agent/severity
- agent/title
- agent/last-modified-date
- agent/tags
- agent/first-publish-date
- agent/event
- vendor/otrs
- canonical/otrs survey
- version/otrs survey/6.0.0
- version/otrs survey/6.0.22
- version/otrs survey/7.0.0
- version/otrs survey/8.0.0
- canonical/otrs otrs
- version/otrs otrs/6.0.0
- version/otrs otrs/6.0.22
- version/otrs otrs/7.0.0
- version/otrs otrs/8.0.0