CVE-2023-38057

XSS stored in survey answers

State: Published
Severity: 4.1 Medium
Published: Jul 24, 2023
Updated: Oct 17, 2024
Reserved: Jul 12, 2023

Description

An improper input validation vulnerability in OTRS Survey modules allows any attacker with a link to a valid and unanswered survey request to inject javascript code in free text answers. This allows a cross site scripting attack while reading the replies as authenticated agent. This issue affects OTRS Survey module from 7.0.X before 7.0.32, from 8.0.X before 8.0.13 and ((OTRS)) Community Edition Survey module from 6.0.X through 6.0.22.

Scores

CVSS	Score	Vector	Source
3.1	4.1 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N	OTRS

Weaknesses

CWE-20 Improper Input Validation

Affected Products

Product	Versions
OTRSOTRS AG	7.0.x to before 7.0.32Affected 8.0.x to before 8.0.13Affected
((OTRS)) Community EditionOTRS AG	6.0.x through 6.0.22Affected

References

https://otrs.com/release-notes/otrs-security-advisory-2023-06/

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.