CVE-2024-43442

Stored XSS in System Configuration

State: Published
Severity: 4.9 Medium
Published: Aug 26, 2024
Updated: Aug 26, 2024
Reserved: Aug 13, 2024

Description

Improper Neutralization of Input done by an attacker with admin privileges ('Cross-site Scripting') in OTRS (System Configuration modules) and ((OTRS)) Community Edition allows Cross-Site Scripting (XSS) within the System Configuration targeting other admins. This issue affects:

* OTRS from 7.0.X through 7.0.50 * OTRS 8.0.X * OTRS 2023.X * OTRS from 2024.X through 2024.5.X * ((OTRS)) Community Edition: 6.0.x

Products based on the ((OTRS)) Community Edition also very likely to be affected

Scores

CVSS	Score	Vector	Source
3.1	4.9 Medium	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N	OTRS

Weaknesses

CWE-790 Improper Filtering of Special Elements
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected Products

Product	Versions
OTRSOTRS AG	7.0.x through 7.0.50Affected 8.0.xAffected 2023.xAffected 2024.x through 2024.5.xAffected
((OTRS)) Community EditionOTRS AG	6.0.xAffected

References

https://otrs.com/release-notes/otrs-security-advisory-2024-10/

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.