CVE-2023-38057: XSS stored in survey answers
An improper input validation vulnerability in OTRS Survey modules allows any attacker with a link to a valid and unanswered survey request to inject javascript code in free text answers. This allows a cross site scripting attack while reading the replies as authenticated agent. This issue affects OTRS Survey module from 7.0.X before 7.0.32, from 8.0.X before 8.0.13 and ((OTRS)) Community Edition Survey module from 6.0.X through 6.0.22.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the vulnerability ID for this OTRS Survey module vulnerability?
The vulnerability ID for this OTRS Survey module vulnerability is CVE-2023-38057.
What is the severity level of CVE-2023-38057?
The severity level of CVE-2023-38057 is medium.
How does the vulnerability in OTRS Survey modules occur?
The vulnerability in OTRS Survey modules occurs due to improper input validation, allowing attackers to inject JavaScript code in free text answers.
Who is affected by this vulnerability?
The vulnerability in OTRS Survey modules affects versions 6.0.0 to 6.0.22, 7.0.0 to 7.0.32, and 8.0.0 to 8.0.13 of the OTRS and OTRS Survey software.
How can I fix the vulnerability in OTRS Survey modules?
To fix the vulnerability in OTRS Survey modules, update to a version of OTRS and OTRS Survey software that is not affected by the vulnerability.