XSS Vulnerability in OTRS2: Risk of Remote Script Injection
Summary
DEBIAN-CVE-2010-4762: Cross-site scripting (XSS) vulnerability in the rich-text-editor component in Open Ticket Request System (OTRS) before 3.0.0-beta2 allows remote authenticated users to inject arbitrary web script or HTML by using the "so... Affects otrs2 versions < 3.0.8+dfsg1-1. Fixed in 3.0.8+dfsg1-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Open Ticket Request System (OTRS) is a widely used open-source ticketing system that helps organizations manage customer support requests efficiently. The software features a rich-text editor component that allows users to format their messages. However, prior to version 3.0.8+dfsg1-1, OTRS2 was susceptible to a cross-site scripting (XSS) vulnerability, which could be exploited by authenticated users to inject malicious scripts into the application.
Vulnerability Detail
The vulnerability arises from the rich-text-editor component in OTRS versions before 3.0.0-beta2. It allows remote authenticated users to exploit the 'source code' feature in the customer interface, leading to the injection of arbitrary web scripts or HTML. This could result in unauthorized actions being performed on behalf of the user, data theft, or other malicious activities.
How To Fix
Minimum fixed version
3.0.8+dfsg1-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade otrs2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, it is advisable to restrict access to the rich-text-editor feature for untrusted users until the package is updated. This can be done by modifying user permissions within the OTRS settings.
Conclusion
The XSS vulnerability in OTRS2 poses a significant risk to users, allowing for potential script injection by authenticated users. It is crucial to update to the patched version to mitigate this risk and ensure the security of the application.
See every vulnerability recorded for otrs2 →
FAQ
The XSS vulnerability allows authenticated users to inject malicious scripts into the application via the rich-text-editor component.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to use the Vulert playground without signup.
Exploitation of this vulnerability can lead to unauthorized actions, data theft, and other malicious activities performed on behalf of the user.
Yes, the vulnerability has been patched in version 3.0.8+dfsg1-1 of OTRS2. It is recommended to update to this version or later.
If immediate updating is not possible, restrict access to the rich-text-editor feature for untrusted users as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for otrs2.
