CVE-2023-5421: Possible XSS execution in customer information
An attacker who is logged into OTRS as an user with privileges to create and change customer user data may manipulate the CustomerID field to execute JavaScript code that runs immediatly after the data is saved.The issue onlyoccurs if the configuration for AdminCustomerUser::UseAutoComplete was changed before. This issue affects OTRS: from 7.0.X before 7.0.47, from 8.0.X before 8.0.37; ((OTRS)) Community Edition: from 6.0.X through 6.0.34.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2023-5421.
What is the severity rating for this vulnerability?
The severity rating for this vulnerability is medium, with a value of 5.5.
How can an attacker exploit this vulnerability?
An attacker who is logged into OTRS as a user with privileges to create and change customer user data can manipulate the CustomerID field to execute JavaScript code.
Which versions of OTRS are affected by this vulnerability?
Versions 6.0.0 to 6.0.34, 7.0.0 to 7.0.47, and 8.0.0 to 8.0.37 of OTRS are affected by this vulnerability.
Is there a fix or patch available for this vulnerability?
Yes, a fix is available. Please refer to the provided reference link for more information.