What is the vulnerability ID for this issue?

The vulnerability ID for this issue is CVE-2023-5421.

What is the severity rating for this vulnerability?

The severity rating for this vulnerability is medium, with a value of 5.5.

How can an attacker exploit this vulnerability?

An attacker who is logged into OTRS as a user with privileges to create and change customer user data can manipulate the CustomerID field to execute JavaScript code.

Which versions of OTRS are affected by this vulnerability?

Versions 6.0.0 to 6.0.34, 7.0.0 to 7.0.47, and 8.0.0 to 8.0.37 of OTRS are affected by this vulnerability.

Is there a fix or patch available for this vulnerability?

Yes, a fix is available. Please refer to the provided reference link for more information.

Vulnerability/
CVE-2023-5421

medium

5.5

CWE

79 20

16/10/2023

16/9/2024

CVE-2023-5421: Possible XSS execution in customer information

First published: Mon Oct 16 2023(Updated: )

An attacker who is logged into OTRS as an user with privileges to create and change customer user data may manipulate the CustomerID field to execute JavaScript code that runs immediatly after the data is saved.The issue onlyoccurs if the configuration for AdminCustomerUser::UseAutoComplete was changed before. This issue affects OTRS: from 7.0.X before 7.0.47, from 8.0.X before 8.0.37; ((OTRS)) Community Edition: from 6.0.X through 6.0.34.

Credit: security@otrs.com security@otrs.com

Affected Software	Affected Version	How to fix
Otrs Otrs	>=6.0.0<=6.0.34
Otrs Otrs	>=7.0.0<7.0.47
Otrs Otrs	>=8.0.0<8.0.37

Remedy

Update to OTRS 7.0.47 or OTRS 8.0.37.

Never miss a vulnerability like this again

Reference Links

https://otrs.com/release-notes/otrs-security-advisory-2023-09/

Frequently Asked Questions

What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2023-5421.
What is the severity rating for this vulnerability?
The severity rating for this vulnerability is medium, with a value of 5.5.
How can an attacker exploit this vulnerability?
An attacker who is logged into OTRS as a user with privileges to create and change customer user data can manipulate the CustomerID field to execute JavaScript code.
Which versions of OTRS are affected by this vulnerability?
Versions 6.0.0 to 6.0.34, 7.0.0 to 7.0.47, and 8.0.0 to 8.0.37 of OTRS are affected by this vulnerability.
Is there a fix or patch available for this vulnerability?
Yes, a fix is available. Please refer to the provided reference link for more information.

collector/nvd-api
collector/nvd-index
agent/weakness
agent/author
agent/type
agent/softwarecombine
collector/mitre-cve
source/MITRE
agent/remedy
agent/last-modified-date
agent/references
agent/title
agent/severity
agent/tags
agent/first-publish-date
agent/description
agent/event
vendor/otrs
canonical/otrs otrs
version/otrs otrs/6.0.0
version/otrs otrs/6.0.34
version/otrs otrs/7.0.0
version/otrs otrs/8.0.0

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.